Getkirby vulnerabilities
47 CVEs and advisories name Getkirby as an affected vendor, newest first. Follow it as a feed.
- CVE-2025-30159Kirby vulnerable to path traversal of snippet names in the `snippet()` helper
- CVE-2024-41964Insufficient permission checks in the language settings in Kirby CMS
- CVE-2024-27087Kirby cross-site scripting (XSS) in the link field "Custom" type
- CVE-2023-38492Kirby vulnerable to denial of service from unlimited password lengths
- CVE-2023-38491Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files
- CVE-2023-38490Kirby XML External Entity (XXE) vulnerability in the XML data handler
- CVE-2023-38489Kirby vulnerable to Insufficient Session Expiration after a password change
- CVE-2023-38488Kirby vulnerable to field injection in the KirbyData text storage handler
- CVE-2022-39315Kirby CMS vulnerable to user enumeration in the brute force protection
- CVE-2022-39314User enumeration in the code-based login and password reset forms
- CVE-2022-36037Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby
- CVE-2021-41258Cross-site scripting (XSS) from image block content in the site frontend
- CVE-2021-41252Cross-site scripting (XSS) from writer field content in the site frontend
- CVE-2021-32735Cross-site scripting (XSS) from field and configuration text displayed in the Panel
- CVE-2021-29460Cross-site scripting (XSS) from unsanitized uploaded SVG files
- CVE-2020-26255PHP Phar archives could be uploaded and executed in Kirby
- CVE-2020-26253.dev domains treated as local in Kirby