dbcve.org
KirbyApplication · Getkirby

CVE-2023-38490

CRITICAL · 10.0 CVSS v3.1 Published 2023-07-27
Fix available
A fix is available. Upgrade to 3.5.8.3 / 3.6.6.3 or later.
See remediation →
100/100
Remediation priority · Urgent
Remotely reachable No privileges Zero-click Patch available

Official description Straight from the sourceThe vendor's or NVD's own wording, published unedited. Authoritative, but often terse — it says what broke, rarely what to do.

NVD · unedited
Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods. XML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF). Kirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation. The `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`). Both the vulnerable method and the data handler are not used in the Kirby core. However they may be used in site or plugin code, e.g. to parse RSS feeds or other XML files. If those files are of an external origin (e.g. uploaded by a user or retrieved from an external URL), attackers may be able to include an external entity in the XML file that will then be processed in the parsing process. Kirby sites that don't use XML parsing in site or plugin code are *not* affected. The problem has been patched in Kirby 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6. In all of the mentioned releases, the maintainers have removed the `LIBXML_NOENT` constant as processing of external entities is out of scope of the parsing logic. This protects all uses of the method against the described vulnerability.

Technical summary Written by usOur analysis, written from the advisory, the CVSS vector and the affected-version data. It adds context the advisory leaves out, and never invents facts that are not in the source.

dbcve analysis · high confidence

Kirby CMS contains an XXE vulnerability in its Xml::parse() method and Xml data handler (Data::decode($string, 'xml')). The methods use PHP's LIBXML_NOENT constant, which enables XML external entity processing. Attackers can craft malicious XML with external entity references to read arbitrary files from the server or perform SSRF attacks.

MitigationUpgrade to Kirby versions 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, or 3.9.6. If upgrading is not immediately feasible, audit all site and plugin code for usage of Xml::parse() or Data::decode() with 'xml' and ensure no untrusted XML sources are processed.

Verify against the referenced sources before acting — the references below are authoritative for this CVE, this summary is not.

Affected products & versions What the vendor confirmedThe version ranges the vendor confirmed as vulnerable. If your version sits inside a range here, treat yourself as exposed until you have upgraded.

NVD · CPE data
KirbyApplication
Affected:>= 3.5.0, < 3.5.8.3>= 3.6.0, < 3.6.6.3>= 3.7.0, < 3.7.5.2>= 3.8.0, < 3.8.4.1>= 3.9.0, < 3.9.6

CVSS breakdown How the score is builtThe industry scoring standard. It rates how the flaw is reached, what it takes to exploit, and what an attacker gains — the score is derived from those, not the other way round.

From the vector
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Scope
Changed
Confidentiality
High
Integrity
High
Availability
None

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:N

Am I affected? How to checkSteps we derive from the advisory and the affected-version data, so you can decide whether this CVE reaches your setup. They are a guide, not a scan — your own configuration is the authority.

dbcve checks

Work through these to decide whether this CVE applies to you.

  1. Check installed Kirby version
    Locate the version.php file in your Kirby installation (typically at /kirby/composer.json or check the panel footer for the version number)
    Affected if The installed version is >= 3.5.0 and < 3.5.8.3, OR >= 3.6.0 and < 3.6.6.3, OR >= 3.7.0 and < 3.7.5.2, OR >= 3.8.0 and < 3.8.4.1, OR >= 3.9.0 and < 3.9.6
  2. Find Xml::parse() usage in custom code
    Search your site and plugin code for calls to Xml::parse() method, for example: grep -r "Xml::parse" /path/to/site/
    Affected if Your codebase contains calls to Xml::parse() that process XML from untrusted or user-controlled sources
  3. Find Data::decode() with xml argument
    Search your site and plugin code for Data::decode() calls with 'xml' as the second parameter, for example: grep -r "Data::decode.*xml" /path/to/site/
    Affected if Your codebase contains Data::decode($string, 'xml') calls that process XML from untrusted or user-controlled sources
  4. Audit XML input sources
    Review your application logic to identify where XML data enters the system, including file uploads, API endpoints, webhooks, or any user-submitted content
    Affected if Your application accepts XML input from external or untrusted sources and passes it to Xml::parse() or Data::decode($string, 'xml')

You are affected if your Kirby version falls within the vulnerable ranges AND your codebase uses Xml::parse() or Data::decode($string, 'xml') to process XML from untrusted sources.

Generated from the published advisory. Verify against your own configuration.

Check your environment

Paste your version and any relevant configuration and it will be compared against the affected criteria above. Do not include secrets or credentials.

AI-assisted, checked against the advisory. Informational, not a guarantee.

Remediation Closing itWhat it takes to close this. Where a vendor fix exists we point at it; where none exists we say so plainly, and can build one. Effort estimates are scoped from the advisory, not from your codebase.

dbcve · scoped
Upgrade available Upgrade to 3.5.8.3 / 3.6.6.3 / 3.7.5.2 or later
Fixed in 3.5.8.33.6.6.33.7.5.2
Vendor patch github.com →
Interim mitigation

Upgrade to Kirby versions 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, or 3.9.6. If upgrading is not immediately feasible, audit all site and plugin code for usage of Xml::parse() or Data::decode() with 'xml' and ensure no untrusted XML sources are processed.

Recommended fix High confidence

3.5.8.3, 3.6.6.3, 3.7.5.2, or 3.8.4.1 (depending on your current major.minor version)

  1. 1. Identify your current Kirby version by checking the kirby/composer.json file or the kirby/composer.json in your installation
  2. 2. Based on your current version, upgrade to the appropriate fixed release: for 3.5.x upgrade to 3.5.8.3; for 3.6.x upgrade to 3.6.6.3; for 3.7.x upgrade to 3.7.5.2; for 3.8.x upgrade to 3.8.4.1
  3. 3. Run composer update getkirby/kirby to apply the upgrade
  4. 4. Clear any cached data if your site uses caching
  5. 5. Verify the upgrade was successful by checking the Kirby version in the panel or via composer show getkirby/kirby
  6. 6. Review site and plugin code that uses Data::decode() with 'xml' or Xml::parse() to confirm the parsing still works correctly after the removal of LIBXML_NOENT
Caveat The removal of LIBXML_NOENT should not break valid XML parsing; if your XML relies on external entity processing, you may need to adjust your code

Generated from the published advisory — verify against the referenced sources before acting.

Fix this in Kirby Scoped from the published advisory
  • Consultation2.0 h
  • Implementation1.0 h
  • Testing3.0 h
  • Review / QA2.0 h
8.0 hours of engineering $1,390
Get the upgrade done

An estimate, not a bill — we confirm scope with you before any work starts. Need it this week? Rush from $2,224.

Scan for this in your stack

Free · runs locally
dbcve dependency scanner

Check whether your project pulls in CVE-2023-38490 — or any other known-vulnerable package — straight from your lock files. Free and open source; it runs locally and uploads nothing.

Get it on GitHub Scan in the browser

References Go to the primary sourcePrimary sources — vendor advisories, patches and trackers. Where our summary and a reference disagree, the reference wins.

Primary sources

Practitioner notes

Contributed

Peer-ranked notes from engineers who’ve handled CVE-2023-38490 in production — separate from our analysis above.

No notes yet

Be the first to add a field note for this CVE — a mitigation you’ve verified, a version caveat, or a link to a working fix. Sign in above to contribute.

What this is

A place for practitioners to share what actually worked: a mitigation you’ve tested, a configuration change, a version- or environment-specific caveat, or a link to a verified patch. The most useful notes rise to the top as peers upvote them, so the signal stays high.

What belongs here
  • Verified mitigations, workarounds, and config changes
  • Version or environment caveats, and links to real fixes
  • No weaponised exploit code, or anything meant to cause harm
  • No spam, self-promotion, credentials, or personal data