# cve.now: Getkirby

The newest entries naming Getkirby as an affected vendor (up to 200), of 47 in all, 0 known exploited. Older ones are in the full catalog at https://cve.now/latest.md.

- [CVE-2026-108924](https://cve.now/CVE-2026-108924.md): getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization (CVSS 5.3)
- [CVE-2026-75594](https://cve.now/CVE-2026-75594.md): Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling (CVSS 8.2)
- [CVE-2026-75592](https://cve.now/CVE-2026-75592.md): Kirby: Access to image files outside of the site root via path traversal in the media handling (CVSS 6.9)
- [CVE-2026-71415](https://cve.now/CVE-2026-71415.md): Kirby: File upload permissions are not checked during processing of chunk data (CVSS 7.1)
- [CVE-2026-69127](https://cve.now/CVE-2026-69127.md): Kirby: System path exposure from error messages in the REST API (CVSS 6.9)
- [CVE-2026-45368](https://cve.now/CVE-2026-45368.md): Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend (CVSS 8.4)
- [CVE-2026-45334](https://cve.now/CVE-2026-45334.md): Kirby: Content locks disclose IDs and emails of inaccessible users from \`users.access/list\` permissions (CVSS 5.3)
- [CVE-2026-44175](https://cve.now/CVE-2026-44175.md): Kirby: Cross-site scripting (XSS) from list field content in the site frontend (CVSS 8.5)
- [CVE-2026-44176](https://cve.now/CVE-2026-44176.md): Kirby: \`pages.access\` permission is not checked during rendering of page drafts (CVSS 6.0)
- [CVE-2026-44177](https://cve.now/CVE-2026-44177.md): Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup (CVSS 8.8)
- [CVE-2026-44174](https://cve.now/CVE-2026-44174.md): Kirby: Arbitrary Method Call via REST API search and collection query endpoints (CVSS 8.7)
- [CVE-2026-49276](https://cve.now/CVE-2026-49276.md): Kirby: Self cross-site scripting (self-XSS) in the writer field (CVSS 7.4)
- [CVE-2026-54005](https://cve.now/CVE-2026-54005.md): Kirby: \`pages.access\` permission is not checked in the \`site/find\` REST API route (CVSS 7.1)
- [CVE-2026-50188](https://cve.now/CVE-2026-50188.md): Kirby: Request header injection in \`Http\\Remote\` (CVSS 6.9)
- [CVE-2026-54004](https://cve.now/CVE-2026-54004.md): Kirby: Access to files of top-level drafts is not protected by permissions (CVSS 6.3)
- [CVE-2026-49274](https://cve.now/CVE-2026-49274.md): Kirby: \`pages.access\` permission is not checked in the pages picker for parent pages (CVSS 5.3)
- [CVE-2026-54003](https://cve.now/CVE-2026-54003.md): Kirby: External Initialization of the Panel on reverse proxy setups with the \`Forwarded\` header (CVSS 9.1)
- [CVE-2026-54002](https://cve.now/CVE-2026-54002.md): Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in \`Dom::sanitize()\` (CVSS 8.5)
- [CVE-2026-42174](https://cve.now/CVE-2026-42174.md): Kirby: User avatar creation, replacement and deletion are not gated by user update permissions (CVSS 5.3)
- [CVE-2026-42137](https://cve.now/CVE-2026-42137.md): Kirby: \`pages.access/list\` and \`files.access/list\` permissions are not consistently checked in the REST API and changes dialog (CVSS 7.1)
- [CVE-2026-42051](https://cve.now/CVE-2026-42051.md): Kirby: System API endpoint leaks license data and installed version to authenticated users (CVSS 5.3)
- [CVE-2026-42069](https://cve.now/CVE-2026-42069.md): Kirby: Read access to site, user and role information is not gated by permissions (CVSS 7.1)
- [CVE-2026-41325](https://cve.now/CVE-2026-41325.md): Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection (CVSS 7.1)
- [CVE-2026-40099](https://cve.now/CVE-2026-40099.md): Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter (CVSS 5.3)
- [CVE-2026-34587](https://cve.now/CVE-2026-34587.md): Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering (CVSS 7.6)
- [CVE-2026-32870](https://cve.now/CVE-2026-32870.md): Kirby has XML injection in its XML creator toolkit (CVSS 6.9)
- [CVE-2026-21896](https://cve.now/CVE-2026-21896.md): Kirby is missing permission checks in the content changes API (CVSS 5.8)
- [CVE-2025-65012](https://cve.now/CVE-2025-65012.md): Kirby CMS has cross-site scripting (XSS) in the changes dialog (CVSS 5.1)
- [CVE-2025-31493](https://cve.now/CVE-2025-31493.md): Path traversal of collection names during file system lookup (CVSS 6.3)
- [CVE-2025-30207](https://cve.now/CVE-2025-30207.md): Kirby vulnerable to path traversal in the router for PHP's built-in server (CVSS 2.3)
- [CVE-2025-30159](https://cve.now/CVE-2025-30159.md): Kirby vulnerable to path traversal of snippet names in the \`snippet()\` helper (CVSS 6.3)
- [CVE-2024-41964](https://cve.now/CVE-2024-41964.md): Insufficient permission checks in the language settings in Kirby CMS (CVSS 8.1)
- [CVE-2024-27087](https://cve.now/CVE-2024-27087.md): Kirby cross-site scripting (XSS) in the link field "Custom" type (CVSS 4.6)
- [CVE-2023-38492](https://cve.now/CVE-2023-38492.md): Kirby vulnerable to denial of service from unlimited password lengths (CVSS 5.3)
- [CVE-2023-38491](https://cve.now/CVE-2023-38491.md): Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files (CVSS 5.7)
- [CVE-2023-38490](https://cve.now/CVE-2023-38490.md): Kirby XML External Entity (XXE) vulnerability in the XML data handler (CVSS 6.8)
- [CVE-2023-38489](https://cve.now/CVE-2023-38489.md): Kirby vulnerable to Insufficient Session Expiration after a password change (CVSS 7.3)
- [CVE-2023-38488](https://cve.now/CVE-2023-38488.md): Kirby vulnerable to field injection in the KirbyData text storage handler (CVSS 7.1)
- [CVE-2022-39315](https://cve.now/CVE-2022-39315.md): Kirby CMS vulnerable to user enumeration in the brute force protection (CVSS 6.5)
- [CVE-2022-39314](https://cve.now/CVE-2022-39314.md): User enumeration in the code-based login and password reset forms (CVSS 4.8)
- [CVE-2022-36037](https://cve.now/CVE-2022-36037.md): Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby (CVSS 5.9)
- [CVE-2021-41258](https://cve.now/CVE-2021-41258.md): Cross-site scripting (XSS) from image block content in the site frontend (CVSS 7.3)
- [CVE-2021-41252](https://cve.now/CVE-2021-41252.md): Cross-site scripting (XSS) from writer field content in the site frontend (CVSS 7.3)
- [CVE-2021-32735](https://cve.now/CVE-2021-32735.md): Cross-site scripting (XSS) from field and configuration text displayed in the Panel (CVSS 7.1)
- [CVE-2021-29460](https://cve.now/CVE-2021-29460.md): Cross-site scripting (XSS) from unsanitized uploaded SVG files (CVSS 7.6)
- [CVE-2020-26255](https://cve.now/CVE-2020-26255.md): PHP Phar archives could be uploaded and executed in Kirby (CVSS 6.8)
- [CVE-2020-26253](https://cve.now/CVE-2020-26253.md): .dev domains treated as local in Kirby (CVSS 6.8)

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/vendors/getkirby
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.