{"items":[{"id":"NVI-00007796","kind":"vulnerability","title":"XML External Entity (XXE) vulnerability in the XML data handler","revision":2,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-q386-w6fg-gmgp","CVE-2023-38490"],"plain_summary":"OSV carries this publisher advisory for getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.5.8.3 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.6.6.3 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.7.5.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.8.4.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.9.6 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"Identify the exact component and deployed version, examine the linked publisher’s conditions, and retain evidence of any mitigation.","source_ids":["sr-d3ffb7b1a4128bbf7cf4f628e87ab046"],"action_type":"investigate","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[{"kind":"EPSS","as_of":"2026-10-31T12:00:27.000Z","value":"1.701%","meaning":"FIRST EPSS model v2026.06.15; exploitation probability over 30 days, percentile 0.77227. Missing scores are unknown.","source_id":"sr-d3ffb7b1a4128bbf7cf4f628e87ab046"}],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-e90eea82fd71cbabd3355fc256def972","url":"https://github.com/advisories/GHSA-q386-w6fg-gmgp","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-q386-w6fg-gmgp","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.997Z"},{"id":"sr-d3ffb7b1a4128bbf7cf4f628e87ab046","url":"https://www.first.org/epss/data.html","basis":"official_catalog","notes":"FIRST EPSS; probability of exploitation in the next 30 days, not local compromise. Dataset date/model retained; FIRST services terms apply.","title":"CVE-2023-38490","publisher":"FIRST EPSS","observed_at":"2026-10-31T22:06:03.704Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.5.8.3"]},{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 3.6.0; fixed 3.6.6.3"]},{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 3.7.0; fixed 3.7.5.2"]},{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 3.8.0; fixed 3.8.4.1"]},{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 3.9.0; fixed 3.9.6"]}],"null_published_at":"2026-11-08T01:52:04.809Z","source_updated_at":"2026-09-10T03:50:02.606Z","source_disclosed_at":"2023-07-28T15:35:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"Dated EPSS estimate updated; this is not a new disclosure or proof of exploitation.","null_first_observed_at":"2026-10-31T21:42:30.997Z"},{"id":"NVI-00007796","kind":"vulnerability","title":"XML External Entity (XXE) vulnerability in the XML data handler","revision":1,"unknowns":["Customer inventory, deployment, reachability and exploitation have not been inspected."],"lifecycle":"active","identifiers":["GHSA-q386-w6fg-gmgp","CVE-2023-38490"],"plain_summary":"OSV carries this publisher advisory for getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms, getkirby/cms. This is an aggregated source copy; consult the original publisher and compare update dates.","review_status":"source_listed","control_topics":[],"public_actions":[{"summary":"The original advisory lists fixed boundaries 3.5.8.3 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.6.6.3 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.7.5.2 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.8.4.1 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null},{"summary":"The original advisory lists fixed boundaries 3.9.6 for getkirby/cms. Confirm the publisher’s latest guidance.","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"action_type":"vendor_patch","limitations":"Confirm current vendor support, compatibility and deployment evidence. This report has not tested a fix in your system.","current_supported_target":null}],"schema_version":"1.1.0","source_metrics":[],"why_it_matters":"Published affected context helps an owner decide what evidence to gather. This report has not examined your application.","related_sources":[{"id":"sr-e90eea82fd71cbabd3355fc256def972","url":"https://github.com/advisories/GHSA-q386-w6fg-gmgp","basis":"vendor_advisory","notes":"GitHub-origin advisory, CC-BY-4.0; OSV is an aggregate copy, not independent corroboration.","title":"GHSA-q386-w6fg-gmgp","publisher":"GitHub Advisory Database via OSV","observed_at":"2026-10-31T21:42:30.997Z"}],"affected_context":[{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 0; fixed 3.5.8.3"]},{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 3.6.0; fixed 3.6.6.3"]},{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 3.7.0; fixed 3.7.5.2"]},{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 3.8.0; fixed 3.8.4.1"]},{"certainty":"source_listed","source_ids":["sr-e90eea82fd71cbabd3355fc256def972"],"technology":"getkirby/cms","known_exclusions":[],"conditions_summary":"### TL;DR\n\nThis vulnerability only affects Kirby sites that use the `Xml` data handler (e.g. `Data::decode($string, 'xml')`) or the `Xml::parse()` method in site or plugin code. The Kirby core does not use any of the affected methods.\n\nIf you use an affected method and cannot rule out XML input controlled by an attacker, we strongly recommend to update to a patch release.\n\n----\n\n### Introduction\n\nXML External Entities (XXE) is a little used feature in the XML markup language that allows to include data from external files in an XML structure. If the name of the external file can be controlled by an attacker, this becomes a vulnerability that can be abused for various system impacts like the disclosure of internal or confidential data that is stored on the server (arbitrary file disclosure) or to perform network requests on behalf of the server (server-side request forgery, SSRF).\n\n### Impact\n\nKirby's `Xml::parse()` method used PHP's `LIBXML_NOENT` constant, which enabled the processing of XML external entities during the parsing operation.\n\nThe `Xml::parse()` method is used in the `Xml` data handler (e.g. `Data::decode($string, 'xml')`).\n\nBoth the vulnerable method and the data han","public_affected_ranges":["ECOSYSTEM: introduced 3.9.0; fixed 3.9.6"]}],"null_published_at":"2026-10-31T22:13:18.635Z","source_updated_at":"2026-09-10T03:50:02.606Z","source_disclosed_at":"2023-07-28T15:35:04.000Z","is_synthetic_fixture":false,"null_last_reviewed_at":null,"public_change_summary":"First indexed by Null; source disclosure date is shown separately.","null_first_observed_at":"2026-10-31T21:42:30.997Z"}],"next_cursor":null,"snapshot_revision":"42594"}