Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2023-38490

31
FAUCET Score

CVE-2023-38490 is a critical XML External Entity (XXE) vulnerability affecting Kirby CMS versions prior to 3.9.6, specifically when custom site or plugin code utilizes the Xml data handler or Xml::parse() method. With a CVSS score of 10.0, this vulnerability allows unauthenticated attackers to achieve arbitrary file disclosure or Server-Side Request Forgery (SSRF) by injecting external entities into XML files processed by vulnerable Kirby installations. While not actively exploited in the wild and lacking public exploit code, the vulnerability has garnered significant community discussion, indicating awareness and potential for future exploitation.

Impacted Technologies

VendorProductVersion(s)CPE
>= 3.5.0, < 3.5.8.3CPE matchmatch criteria
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
>= 3.6.0, < 3.6.6.3CPE matchmatch criteria
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
>= 3.7.0, < 3.7.5.2CPE matchmatch criteria
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
>= 3.8.0, < 3.8.4.1CPE matchmatch criteria
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
>= 3.9.0, < 3.9.6CPE matchmatch criteria
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

6.8MEDIUM

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:N/A:N

Attack Vector
NETWORK
Attack Complexity
HIGH
Privileges Required
NONE
User Interaction
NONE
Scope
CHANGED
Confidentiality Impact
HIGH
Integrity Impact
NONE
Availability Impact
NONE
Exploitability Score
2.2
Impact Score
4.0
CvssVersion
3.1

Exploit Intelligence

EPSS Score
1.53%
Probability of exploitation in next 30 days
EPSS Percentile
72.0%
Percentile rank of EPSS score among Peer Group
As of 2026-07-24
Model: v2026.06.15
This CVE's current EPSS score of 0.0153 is in the 59th percentile among its peer group of 36,821 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.1 Reddit, 0.3 Bluesky, 0.3 Mastodon, and 2.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.3 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (6)

composerpatch availablevia ghsa
Product: getkirby/cmsFixed in: 3.5.8.3
composerpatch availablevia ghsa
Product: getkirby/cmsFixed in: 3.6.6.3
composerpatch availablevia ghsa
Product: getkirby/cmsFixed in: 3.7.5.2
composerpatch availablevia ghsa
Product: getkirby/cmsFixed in: 3.8.4.1
composerpatch availablevia ghsa
Product: getkirby/cmsFixed in: 3.9.6
github_advisorypatch availablevia nvd_reference
View patch

Vendor Advisories (1)

composerGHSA-q386-w6fg-gmgpmedium

XML External Entity (XXE) vulnerability in the XML data handler

Jul 28, 2023

References

github.com / getkirby/kirby/commit/277b05662d2b67386f0a0f18323cf68b30e86387
PatchThird Party Advisory
github.com / getkirby/kirby/releases/tag/3.5.8.3
Third Party Advisory
github.com / getkirby/kirby/releases/tag/3.6.6.3
Third Party Advisory
github.com / getkirby/kirby/releases/tag/3.7.5.2
Third Party Advisory
github.com / getkirby/kirby/releases/tag/3.8.4.1
Third Party Advisory
github.com / getkirby/kirby/releases/tag/3.9.6
Third Party Advisory
github.com / getkirby/kirby/security/advisories/GHSA-q386-w6fg-gmgp
Third Party Advisory