Threats tagged 'ghsa-jcjw-58rv-c452'

Kirby CMS versions prior to 4.9.0 and versions from 5.0.0 up to but not including 5.4.0 have a Server-Side Template Injection (SSTI) vulnerability in option fields that use dynamic options from queries or APIs. This vulnerability allows authenticated Panel users or users interacting with the Panel to inject malicious template queries that are double-resolved, potentially leading to unauthorized information disclosure or unauthorized content modification. The issue is patched in Kirby 4.9.0 and 5.4.0 and later versions.