Getkirby vulnerabilities
47 CVEs and advisories name Getkirby as an affected vendor, newest first. Follow it as a feed.
- CVE-2026-108924getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
- CVE-2026-75594Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
- CVE-2026-75592Kirby: Access to image files outside of the site root via path traversal in the media handling
- CVE-2026-71415Kirby: File upload permissions are not checked during processing of chunk data
- CVE-2026-69127Kirby: System path exposure from error messages in the REST API
- CVE-2026-45368Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
- CVE-2026-45334Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
- CVE-2026-44175Kirby: Cross-site scripting (XSS) from list field content in the site frontend
- CVE-2026-44176Kirby: `pages.access` permission is not checked during rendering of page drafts
- CVE-2026-44177Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup
- CVE-2026-44174Kirby: Arbitrary Method Call via REST API search and collection query endpoints
- CVE-2026-49276Kirby: Self cross-site scripting (self-XSS) in the writer field
- CVE-2026-54005Kirby: `pages.access` permission is not checked in the `site/find` REST API route
- CVE-2026-50188Kirby: Request header injection in `Http\Remote`
- CVE-2026-54004Kirby: Access to files of top-level drafts is not protected by permissions
- CVE-2026-49274Kirby: `pages.access` permission is not checked in the pages picker for parent pages
- CVE-2026-54003Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
- CVE-2026-54002Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
- CVE-2026-42174Kirby: User avatar creation, replacement and deletion are not gated by user update permissions
- CVE-2026-42137Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog
- CVE-2026-42051Kirby: System API endpoint leaks license data and installed version to authenticated users
- CVE-2026-42069Kirby: Read access to site, user and role information is not gated by permissions
- CVE-2026-41325Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
- CVE-2026-40099Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
- CVE-2026-34587Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
- CVE-2026-32870Kirby has XML injection in its XML creator toolkit
- CVE-2026-21896Kirby is missing permission checks in the content changes API
- CVE-2025-65012Kirby CMS has cross-site scripting (XSS) in the changes dialog
- CVE-2025-31493Path traversal of collection names during file system lookup
- CVE-2025-30207Kirby vulnerable to path traversal in the router for PHP's built-in server