# getkirby/cms (Packagist) vulnerabilities 50 known vulnerabilities (1 critical, 21 high, 25 medium, 1 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Registry: https://packagist.org/packages/getkirby/cms ## Advisories (50) ### [CVE-2026-75594](https://cve.now/CVE-2026-75594): Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling - Severity: High 8.2 - Published: Aug 31, 2026 - Affected: fixed in 4.9.5; from 5.0.0, fixed in 5.5.2. ### [CVE-2026-75592](https://cve.now/CVE-2026-75592): Kirby: Access to image files outside of the site root via path traversal in the media handling - Severity: Medium 6.9 - Published: Aug 31, 2026 - Affected: fixed in 4.9.5; from 5.0.0, fixed in 5.5.2. ### [CVE-2026-71415](https://cve.now/CVE-2026-71415): Kirby: File upload permissions are not checked during processing of chunk data - Severity: High 7.1 - Published: Aug 31, 2026 - Affected: from 5.0.0, fixed in 5.5.2. ### [CVE-2026-69127](https://cve.now/CVE-2026-69127): Kirby: System path exposure from error messages in the REST API - Severity: Medium 6.9 - Published: Aug 7, 2026 - Affected: fixed in 4.9.5; from 5.0.0, fixed in 5.5.2. ### [CVE-2026-45368](https://cve.now/CVE-2026-45368): Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend - Severity: High 8.4 - Published: Jul 16, 2026 - Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1. ### [CVE-2026-45334](https://cve.now/CVE-2026-45334): Kirby: Content locks disclose IDs and emails of inaccessible users from \`users.access/list\` permissions - Severity: Medium 5.3 - Published: Jul 16, 2026 - Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1. ### [CVE-2026-44175](https://cve.now/CVE-2026-44175): Kirby: Cross-site scripting (XSS) from list field content in the site frontend - Severity: High 8.5 - Published: Jul 16, 2026 - Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1. ### [CVE-2026-44176](https://cve.now/CVE-2026-44176): Kirby: \`pages.access\` permission is not checked during rendering of page drafts - Severity: Medium 6.0 - Published: Jul 16, 2026 - Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1. ### [CVE-2026-44177](https://cve.now/CVE-2026-44177): Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup - Severity: High 8.8 - Published: Jul 16, 2026 - Affected: from 5.3.0, fixed in 5.4.1. ### [CVE-2026-44174](https://cve.now/CVE-2026-44174): Kirby: Arbitrary Method Call via REST API search and collection query endpoints - Severity: High 8.7 - Published: Jul 16, 2026 - Affected: fixed in 4.9.1; from 5.0.0, fixed in 5.4.1. ### [CVE-2026-49276](https://cve.now/CVE-2026-49276): Kirby: Self cross-site scripting (self-XSS) in the writer field - Severity: High 7.4 - Published: Jul 9, 2026 - Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4. ### [CVE-2026-54005](https://cve.now/CVE-2026-54005): Kirby: \`pages.access\` permission is not checked in the \`site/find\` REST API route - Severity: High 7.1 - Published: Jul 9, 2026 - Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4. ### [CVE-2026-50188](https://cve.now/CVE-2026-50188): Kirby: Request header injection in \`Http\\Remote\` - Severity: Medium 6.9 - Published: Jul 9, 2026 - Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4. ### [CVE-2026-54004](https://cve.now/CVE-2026-54004): Kirby: Access to files of top-level drafts is not protected by permissions - Severity: Medium 6.3 - Published: Jul 9, 2026 - Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4. ### [CVE-2026-49274](https://cve.now/CVE-2026-49274): Kirby: \`pages.access\` permission is not checked in the pages picker for parent pages - Severity: Medium 5.3 - Published: Jul 9, 2026 - Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4. ### [CVE-2026-54003](https://cve.now/CVE-2026-54003): Kirby: External Initialization of the Panel on reverse proxy setups with the \`Forwarded\` header - Severity: Critical 9.1 - Published: Jul 9, 2026 - Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4. ### [CVE-2026-54002](https://cve.now/CVE-2026-54002): Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in \`Dom::sanitize()\` - Severity: High 8.5 - Published: Jul 9, 2026 - Affected: fixed in 4.9.4; from 5.0.0-alpha.1, fixed in 5.4.4. ### [CVE-2026-42174](https://cve.now/CVE-2026-42174): Kirby: User avatar creation, replacement and deletion are not gated by user update permissions - Severity: Medium 5.3 - Published: May 9, 2026 - Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0. ### [CVE-2026-42137](https://cve.now/CVE-2026-42137): Kirby: \`pages.access/list\` and \`files.access/list\` permissions are not consistently checked in the REST API and changes dialog - Severity: High 7.1 - Published: May 9, 2026 - Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0. ### [CVE-2026-42051](https://cve.now/CVE-2026-42051): Kirby: System API endpoint leaks license data and installed version to authenticated users - Severity: Medium 5.3 - Published: May 9, 2026 - Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0. ### [CVE-2026-42069](https://cve.now/CVE-2026-42069): Kirby: Read access to site, user and role information is not gated by permissions - Severity: High 7.1 - Published: May 9, 2026 - Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0. ### [CVE-2026-41325](https://cve.now/CVE-2026-41325): Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection - Severity: High 7.1 - Published: Apr 24, 2026 - Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0. ### [CVE-2026-40099](https://cve.now/CVE-2026-40099): Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter - Severity: Medium 5.3 - Published: Apr 24, 2026 - Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0. ### [CVE-2026-34587](https://cve.now/CVE-2026-34587): Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering - Severity: High 7.6 - Published: Apr 24, 2026 - Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0. ### [CVE-2026-32870](https://cve.now/CVE-2026-32870): Kirby has XML injection in its XML creator toolkit - Severity: Medium 6.9 - Published: Apr 24, 2026 - Affected: fixed in 4.9.0; from 5.0.0, fixed in 5.4.0. ### [CVE-2026-21896](https://cve.now/CVE-2026-21896): Kirby is missing permission checks in the content changes API - Severity: Medium 5.8 - Published: Jan 8, 2026 - Affected: from 5.0.0, fixed in 5.2.2. ### [CVE-2025-65012](https://cve.now/CVE-2025-65012): Kirby CMS has cross-site scripting (XSS) in the changes dialog - Severity: Medium 5.1 - Published: Nov 18, 2025 - Affected: from 5.0.0, fixed in 5.1.4. ### [CVE-2025-31493](https://cve.now/CVE-2025-31493): Path traversal of collection names during file system lookup - Severity: Medium 6.3 - Published: May 13, 2025 - Affected: fixed in 3.9.8.3; from 3.10.0, fixed in 3.10.1.2; from 4.0.0, fixed in 4.7.1. ### [CVE-2025-30207](https://cve.now/CVE-2025-30207): Kirby vulnerable to path traversal in the router for PHP's built-in server - Severity: Low 2.3 - Published: May 13, 2025 - Affected: fixed in 3.9.8.3; from 3.10.0, fixed in 3.10.1.2; from 4.0.0, fixed in 4.7.1. ### [CVE-2024-41964](https://cve.now/CVE-2024-41964): Insufficient permission checks in the language settings in Kirby CMS - Severity: High 8.1 - Published: Aug 29, 2024 - Affected: fixed in 3.6.6.6; from 3.7.0, fixed in 3.7.5.5; from 3.8.0, fixed in 3.8.4.4; from 3.9.0, fixed in 3.9.8.2; from 3.10.0, fixed in 3.10.1.1; from 4.0.0, fixed in 4.3.1. ### [CVE-2024-27087](https://cve.now/CVE-2024-27087): Kirby cross-site scripting (XSS) in the link field "Custom" type - Severity: Medium 4.6 - Published: Feb 26, 2024 - Affected: from 4.0.0, fixed in 4.1.1. ### [CVE-2024-26483](https://cve.now/CVE-2024-26483): An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a… - Severity: High 8.8 - Published: Feb 22, 2024 - Affected: fixed in 3.6.6.5; from 3.7.0, fixed in 3.7.5.4; from 3.8.0, fixed in 3.8.4.3; from 3.9.0, fixed in 3.9.8.1; from 3.10.0, fixed in 3.10.0.1; from 4.0.0, fixed in 4.1.1. ### [CVE-2024-26481](https://cve.now/CVE-2024-26481): Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. - Severity: Medium 4.7 - Published: Feb 22, 2024 - Affected: fixed in 3.6.6.5; from 3.7.0, fixed in 3.7.5.4; from 3.8.0, fixed in 3.8.4.3; from 3.9.0, fixed in 3.9.8.1; from 3.10.0, fixed in 3.10.0.1; from 4.0.0, fixed in 4.1.1. ### [CVE-2023-38492](https://cve.now/CVE-2023-38492): Kirby vulnerable to denial of service from unlimited password lengths - Severity: Medium 5.3 - Published: Jul 27, 2023 - Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6. ### [CVE-2023-38491](https://cve.now/CVE-2023-38491): Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files - Severity: Medium 5.7 - Published: Jul 27, 2023 - Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6. ### [CVE-2023-38490](https://cve.now/CVE-2023-38490): Kirby XML External Entity (XXE) vulnerability in the XML data handler - Severity: Medium 6.8 - Published: Jul 27, 2023 - Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6. ### [CVE-2023-38489](https://cve.now/CVE-2023-38489): Kirby vulnerable to Insufficient Session Expiration after a password change - Severity: High 7.3 - Published: Jul 27, 2023 - Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6. ### [CVE-2023-38488](https://cve.now/CVE-2023-38488): Kirby vulnerable to field injection in the KirbyData text storage handler - Severity: High 7.1 - Published: Jul 27, 2023 - Affected: fixed in 3.5.8.3; from 3.6.0, fixed in 3.6.6.3; from 3.7.0, fixed in 3.7.5.2; from 3.8.0, fixed in 3.8.4.1; from 3.9.0, fixed in 3.9.6. ### [CVE-2022-39315](https://cve.now/CVE-2022-39315): Kirby CMS vulnerable to user enumeration in the brute force protection - Severity: Medium 6.5 - Published: Oct 25, 2022 - Affected: fixed in 3.5.8.2; from 3.6.0, fixed in 3.6.6.2; from 3.7.0, fixed in 3.7.5.1; from 3.8.0, fixed in 3.8.1. ### [CVE-2022-39314](https://cve.now/CVE-2022-39314): User enumeration in the code-based login and password reset forms - Severity: Medium 4.8 - Published: Oct 24, 2022 - Affected: from 3.5.0, fixed in 3.5.8.2; from 3.6.0, fixed in 3.6.6.2; from 3.7.0, fixed in 3.7.5.1; from 3.8.0, fixed in 3.8.1. ### [CVE-2022-36037](https://cve.now/CVE-2022-36037): Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby - Severity: Medium 5.9 - Published: Aug 29, 2022 - Affected: fixed in 3.5.8.1. ### [CVE-2018-14519](https://cve.now/CVE-2018-14519): An issue was discovered in Kirby 2.5.12. - Severity: Unrated - Published: Aug 24, 2022 - Affected: through 2.5.12. ### [CVE-2018-14520](https://cve.now/CVE-2018-14520): An issue was discovered in Kirby 2.5.12. - Severity: Medium 5.4 - Published: Aug 24, 2022 - Affected: through 2.5.12. ### [CVE-2021-41258](https://cve.now/CVE-2021-41258): Cross-site scripting (XSS) from image block content in the site frontend - Severity: High 7.3 - Published: Nov 16, 2021 - Affected: from 3.5.0, fixed in 3.5.8. ### [CVE-2021-41252](https://cve.now/CVE-2021-41252): Cross-site scripting (XSS) from writer field content in the site frontend - Severity: High 7.3 - Published: Nov 16, 2021 - Affected: from 3.5.0, fixed in 3.5.8. ### [CVE-2021-32735](https://cve.now/CVE-2021-32735): Cross-site scripting (XSS) from field and configuration text displayed in the Panel - Severity: High 7.1 - Published: Jul 2, 2021 - Affected: fixed in 3.5.7. ### [CVE-2021-29460](https://cve.now/CVE-2021-29460): Cross-site scripting (XSS) from unsanitized uploaded SVG files - Severity: High 7.6 - Published: Apr 27, 2021 - Affected: fixed in 3.5.4. ### [CVE-2020-26255](https://cve.now/CVE-2020-26255): PHP Phar archives could be uploaded and executed in Kirby - Severity: Medium 6.8 - Published: Dec 8, 2020 - Affected: from 3.0.0, fixed in 3.4.5. ### [CVE-2020-26253](https://cve.now/CVE-2020-26253): .dev domains treated as local in Kirby - Severity: Medium 6.8 - Published: Dec 8, 2020 - Affected: from 3.0.0, fixed in 3.3.6. ### [CVE-2017-16807](https://cve.now/CVE-2017-16807): A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying… - Severity: Unrated - Published: Nov 13, 2017 - Affected: fixed in 2.3.3; from 2.4, fixed in 2.4.2; from 2.5, fixed in 2.5.7. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/packagist/getkirby/cms Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.