Skip to main content
cve.nowby Sazabi
← Packagist
PackagistPackage

getkirby/cms

50 known vulnerabilities (1 critical, 21 high, 25 medium, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
50 · 1 critical, 21 high, 25 medium, 1 low
Registry
Packagist

Advisories 50

  • Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

    Affected: fixed in 4.9.5; from 5.0.0, fixed in 5.5.2.

  • CVE-2026-75592Medium 6.9

    Kirby: Access to image files outside of the site root via path traversal in the media handling

    Affected: fixed in 4.9.5; from 5.0.0, fixed in 5.5.2.

  • Kirby: File upload permissions are not checked during processing of chunk data

    Affected: from 5.0.0, fixed in 5.5.2.

  • CVE-2026-69127Medium 6.9

    Kirby: System path exposure from error messages in the REST API

    Affected: fixed in 4.9.5; from 5.0.0, fixed in 5.5.2.

  • Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

    Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1.

  • CVE-2026-45334Medium 5.3

    Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions

    Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1.

  • Kirby: Cross-site scripting (XSS) from list field content in the site frontend

    Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1.

  • CVE-2026-44176Medium 6.0

    Kirby: `pages.access` permission is not checked during rendering of page drafts

    Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1.

  • Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup

    Affected: from 5.3.0, fixed in 5.4.1.

  • Kirby: Arbitrary Method Call via REST API search and collection query endpoints

    Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1.

  • Kirby: Self cross-site scripting (self-XSS) in the writer field

    Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4.

  • Kirby: `pages.access` permission is not checked in the `site/find` REST API route

    Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4.

  • CVE-2026-50188Medium 6.9

    Kirby: Request header injection in `Http\Remote`

    Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4.

  • CVE-2026-54004Medium 6.3

    Kirby: Access to files of top-level drafts is not protected by permissions

    Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4.

  • CVE-2026-49274Medium 5.3

    Kirby: `pages.access` permission is not checked in the pages picker for parent pages

    Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4.

Show all 50 advisoriesShow fewer advisories
  • CVE-2026-54003Critical 9.1

    Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

    Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4.

  • Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`

    Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4.

  • CVE-2026-42174Medium 5.3

    Kirby: User avatar creation, replacement and deletion are not gated by user update permissions

    Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0.

  • Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog

    Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0.

  • CVE-2026-42051Medium 5.3

    Kirby: System API endpoint leaks license data and installed version to authenticated users

    Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0.

  • Kirby: Read access to site, user and role information is not gated by permissions

    Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0.

  • Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

    Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0.

  • CVE-2026-40099Medium 5.3

    Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

    Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0.

  • Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

    Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0.

  • CVE-2026-32870Medium 6.9

    Kirby has XML injection in its XML creator toolkit

    Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0.

  • CVE-2026-21896Medium 5.8

    Kirby is missing permission checks in the content changes API

    Affected: from 5.0.0, fixed in 5.2.2.

  • CVE-2025-65012Medium 5.1

    Kirby CMS has cross-site scripting (XSS) in the changes dialog

    Affected: from 5.0.0, fixed in 5.1.4.

  • CVE-2025-31493Medium 6.3

    Path traversal of collection names during file system lookup

    Affected: fixed in 3.9.8.3; from 3.10.0, fixed in 3.10.1.2; from 4.0.0, fixed in 4.7.1.

  • Kirby vulnerable to path traversal in the router for PHP's built-in server

    Affected: fixed in 3.9.8.3; from 3.10.0, fixed in 3.10.1.2; from 4.0.0, fixed in 4.7.1.

  • Insufficient permission checks in the language settings in Kirby CMS

    Affected: fixed in 3.6.6.6; from 3.7.0, fixed in 3.7.5.5; from 3.8.0, fixed in 3.8.4.4; from 3.9.0, fixed in 3.9.8.2; from 3.10.0, fixed in 3.10.1.1; from 4.0.0, fixed in 4.3.1.

  • CVE-2024-27087Medium 4.6

    Kirby cross-site scripting (XSS) in the link field "Custom" type

    Affected: from 4.0.0, fixed in 4.1.1.

  • An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a…

    Affected: fixed in 3.6.6.5; from 3.7.0, fixed in 3.7.5.4; from 3.8.0, fixed in 3.8.4.3; from 3.9.0, fixed in 3.9.8.1; from 3.10.0, fixed in 3.10.0.1; from 4.0.0, fixed in 4.1.1.

  • CVE-2024-26481Medium 4.7

    Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.

    Affected: fixed in 3.6.6.5; from 3.7.0, fixed in 3.7.5.4; from 3.8.0, fixed in 3.8.4.3; from 3.9.0, fixed in 3.9.8.1; from 3.10.0, fixed in 3.10.0.1; from 4.0.0, fixed in 4.1.1.

  • CVE-2023-38492Medium 5.3

    Kirby vulnerable to denial of service from unlimited password lengths

    Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6.

  • CVE-2023-38491Medium 5.7

    Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

    Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6.

  • CVE-2023-38490Medium 6.8

    Kirby XML External Entity (XXE) vulnerability in the XML data handler

    Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6.

  • Kirby vulnerable to Insufficient Session Expiration after a password change

    Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6.

  • Kirby vulnerable to field injection in the KirbyData text storage handler

    Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6.

  • CVE-2022-39315Medium 6.5

    Kirby CMS vulnerable to user enumeration in the brute force protection

    Affected: fixed in 3.5.8.2; from 3.6.0, fixed in 3.6.6.2; from 3.7.0, fixed in 3.7.5.1; from 3.8.0, fixed in 3.8.1.

  • CVE-2022-39314Medium 4.8

    User enumeration in the code-based login and password reset forms

    Affected: from 3.5.0, fixed in 3.5.8.2; from 3.6.0, fixed in 3.6.6.2; from 3.7.0, fixed in 3.7.5.1; from 3.8.0, fixed in 3.8.1.

  • CVE-2022-36037Medium 5.9

    Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby

    Affected: fixed in 3.5.8.1.

  • An issue was discovered in Kirby 2.5.12.

    Affected: through 2.5.12.

  • CVE-2018-14520Medium 5.4

    An issue was discovered in Kirby 2.5.12.

    Affected: through 2.5.12.

  • Cross-site scripting (XSS) from image block content in the site frontend

    Affected: from 3.5.0, fixed in 3.5.8.

  • Cross-site scripting (XSS) from writer field content in the site frontend

    Affected: from 3.5.0, fixed in 3.5.8.

  • Cross-site scripting (XSS) from field and configuration text displayed in the Panel

    Affected: fixed in 3.5.7.

  • Cross-site scripting (XSS) from unsanitized uploaded SVG files

    Affected: fixed in 3.5.4.

  • CVE-2020-26255Medium 6.8

    PHP Phar archives could be uploaded and executed in Kirby

    Affected: from 3.0.0, fixed in 3.4.5.

  • CVE-2020-26253Medium 6.8

    .dev domains treated as local in Kirby

    Affected: from 3.0.0, fixed in 3.3.6.

  • A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying…

    Affected: fixed in 2.3.3; from 2.4, fixed in 2.4.2; from 2.5, fixed in 2.5.7.