CVE-2026-49276 is an improper neutralization of script in attributes vulnerability (CWE-83) affecting the Kirby content management system. Specifically, in versions before 4.9.4 and 5.4.4, the writer field in any blueprint allows an attacker to insert a scripting link as the target of a link or email link in writer mark components. This causes the target to become clickable and enables self cross-site scripting within the Panel, potentially allowing script execution in the context of the user who entered the link. The vulnerability has a CVSS 4.0 score of 7.4 (high severity) and requires user interaction to exploit. The issue is fixed in Kirby versions 4.9.4 and 5.4.4.

Successful exploitation allows an attacker to execute arbitrary scripts in the context of the authenticated user within the Kirby Panel interface. This can lead to unauthorized actions or disclosure of sensitive information accessible to the user. The vulnerability requires user interaction and has a high complexity due to the need for a user to click the malicious link. There are no known exploits in the wild at this time.

Upgrade Kirby CMS to version 4.9.4 or later, or 5.4.4 or later, where this vulnerability is fixed. No other mitigation or temporary workaround is indicated by the vendor advisory. Patch status is confirmed fixed in these versions.