Kirby's Xml::value() method improperly handles CDATA boilerplate when the input contains a valid CDATA section combined with extraneous XML markup. The flaw, a CWE‑91 weakness, allows attacker supplied input to bypass escaping and embed arbitrary XML fragments into output generated by site or plugin code. This could result in content tampering or manipulation of downstream systems that parse the flawed output.

The problem exists in Kirby CMS versions prior to 4.9.0 in the 4.x series and prior to 5.4.0 in the 5.x series. It only affects sites or plugins that use the vulnerable XML creation utilities—Xml::tag(), Xml::create(), or Data::encode() with the 'xml' type. Sites that do not generate XML within their environment are not vulnerable.

The CVSS score of 6.9 indicates moderate severity, while the EPSS score of less than 1% suggests low likelihood of exploitation in the wild. The vulnerability is not listed in CISA's KEV catalog. Exploitation would require an attacker to supply crafted input to the vulnerable XML functions, likely through a user‑facing form or a malicious plugin. The likely attack vector is an untrusted input channel that reaches these XML helpers. If an attacker succeeds, they can inject XML elements that downstream consumers might trust, leading to data corruption or privilege escalation within those workflows.