{"kind": "product", "path": "vulns/packagist/getkirby%2Fcms", "name": "getkirby/cms", "product": "getkirby/cms", "ecosystem": "Packagist", "items": [{"id": "CVE-2026-75594", "noindex": false, "published": "2026-08-31T20:53:00.338Z", "modified": "2026-09-01T14:31:42.348Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00762, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-75594", "title": "Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling", "description": "Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename k", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w", "https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9", "https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20"], "fixes": ["4.9.5", "5.5.2"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-75592", "noindex": false, "published": "2026-08-31T20:49:41.341Z", "modified": "2026-09-01T13:41:40.500Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:H/SI:N/SA:N", "severity": "medium", "epss": 0.00676, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-75592", "title": "Kirby: Access to image files outside of the site root via path traversal in the media handling", "description": "Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\\Filesystem\\Dir::realpath() and Kirby\\Filesystem\\F::realpath(). The checks accepted a sibling directory whose path shared the intended root's string prefix, such as /var/www/site2 next to /var/www/site, because they did not require an exact match or a DIRECTORY_SEPARATOR boundary. A remote attacker could use Kirby\\Cms\\Media::thumb() to create and access thumbnails from image files in a PHP-readable sibling ", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-6j4c-mgqr-qv76", "https://github.com/getkirby/kirby/commit/2b6fab950bc89d505ea89576bf71c8de614cc3b2", "https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c"], "fixes": ["4.9.5", "5.5.2"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-71415", "noindex": false, "published": "2026-08-31T20:46:02.280Z", "modified": "2026-09-03T18:02:09.849Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-71415", "title": "Kirby: File upload permissions are not checked during processing of chunk data", "description": "Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\\Api\\Upload::process() before Kirby\\Api\\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploa", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-67mx-6wf2-92xp", "https://github.com/getkirby/kirby/pull/8296", "https://github.com/getkirby/kirby/commit/37e206f3ed40ad3fab2e47e055ccb19e9c207dab"], "fixes": ["5.5.2"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-69127", "noindex": false, "published": "2026-08-07T18:33:19.614Z", "modified": "2026-08-11T22:11:56.971Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00699, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-69127", "title": "Kirby: System path exposure from error messages in the REST API", "description": "Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh", "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0", "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451"], "fixes": ["4.9.5", "5.5.2"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45368", "noindex": false, "published": "2026-07-16T21:49:46.244Z", "modified": "2026-07-18T03:18:56.903Z", "cvss": 8.4, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00534, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45368", "title": "Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend", "description": "Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks components did not filter out malicious URL values that resolve to script execution. The vulnerability affects four first-party Kirby renderers that produce `<a href=\"…\">` output from editor-supplied field values: the (`link: …)` KirbyTag, the `link`: parameter of the `(image: …)` KirbyTag when it does not resolve to a known file or `self`, the `link` field of the built-in image block, and the HTML importer for the `blocks` field (which accepted the same malicious input as the image block `link", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-qvjf-922g-pj44", "https://github.com/getkirby/kirby/releases/tag/5.4.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-45368"], "fixes": ["4.9.1", "5.4.1"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-45334", "noindex": false, "published": "2026-07-16T21:42:51.081Z", "modified": "2026-07-17T18:06:29.822Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00364, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-45334", "title": "Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions", "description": "Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking the requesting user's access permissions. Kirby's Panel includes a content-locking feature that records which user currently has a model open for editing. This lock prevents conflicting edits by multiple users and displays the locking user's identity in the Panel UI so other users know who to contact. Internally, the locking user's email address and identifier are included in every Panel view payload and in error responses returned when a user attempts to edit a model that is currently", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-39vq-49qm-r2mc", "https://github.com/getkirby/kirby/releases/tag/5.4.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-45334"], "fixes": ["4.9.1", "5.4.1"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-44175", "noindex": false, "published": "2026-07-16T21:36:06.390Z", "modified": "2026-07-17T13:11:28.792Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0043, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-44175", "title": "Kirby: Cross-site scripting (XSS) from list field content in the site frontend", "description": "Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save, leaving it vulnerable to cross-site scripting (XSS). Kirby's list field stores its formatted content as HTML, and unlike other field types, its HTML special characters cannot be escaped without losing the formatting. Sanitization was only enforced client-side in the Panel, while the server did not sanitize the content on save. As a result, an attacker could bypass the Panel and send malicious HTML directly to Kirby's API, storing unsanitized markup in the content file. That markup wou", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-5fhx-9q32-q257", "https://github.com/getkirby/kirby/releases/tag/5.4.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-44175"], "fixes": ["4.9.1", "5.4.1"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-44176", "noindex": false, "published": "2026-07-16T21:24:04.415Z", "modified": "2026-07-17T11:11:07.047Z", "cvss": 6, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00364, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-44176", "title": "Kirby: `pages.access` permission is not checked during rendering of page drafts", "description": "Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` permission  during page draft rendering. Permissions are defined for each user role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model in the model blueprints (such as in site/blueprints/pages/...) using the options feature. The permissions and options together control the authorization of user actions. Kirby provides the pages.access and pages.list permissions (among others). The list permission controls whether affected models appear in lists throughout th", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-2xw4-v2wx-hqq9", "https://github.com/getkirby/kirby/releases/tag/5.4.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-44176"], "fixes": ["4.9.1", "5.4.1"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-44177", "noindex": false, "published": "2026-07-16T21:19:16.783Z", "modified": "2026-07-17T13:43:43.332Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0177, "kev": false, "exploits": ["nuclei"], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-44177", "title": "Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup", "description": "Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user objects lazily when first needed. Users were queried by their ID, which was then used to locate the corresponding account directory under site/accounts. This affected the authentication API (accessible to unauthenticated requests), the users API (accessible only to authenticated users), and any other place that uses $users->find() to look up an individual u", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-9hx7-c53c-v6x8", "https://github.com/getkirby/kirby/releases/tag/5.4.1", "https://nvd.nist.gov/vuln/detail/CVE-2026-44177"], "fixes": ["5.4.1"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-44174", "noindex": false, "published": "2026-07-16T21:13:43.133Z", "modified": "2026-07-18T03:17:09.100Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00487, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-44174", "title": "Kirby: Arbitrary Method Call via REST API search and collection query endpoints", "description": "Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowing attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password() (disclosing the password hash) or root() (disclosing the absolute filesystem path on the server) as well as methods that perform impactful actions such as loginPasswordless() (causing a privilege escalation to another user) or delete() (deleting all queried models in one go if the authenticated user has appropriate permissions). This issue has been fix", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-86rh-h242-j8xp", "https://github.com/getkirby/kirby/releases/tag/4.9.1", "https://github.com/getkirby/kirby/releases/tag/5.4.1"], "fixes": ["4.9.1", "5.4.1"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-49276", "noindex": false, "published": "2026-07-09T18:48:50.543Z", "modified": "2026-07-10T14:11:49.896Z", "cvss": 7.4, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:A/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00432, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-49276", "title": "Kirby: Self cross-site scripting (self-XSS) in the writer field", "description": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be included as the target of a link or email link in writer mark components, making the target clickable by the user who entered it and enabling self cross-site scripting in the Panel. This issue is fixed in versions 4.9.4 and 5.4.4.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-rhj6-r49h-5932", "https://github.com/getkirby/kirby/releases/tag/4.9.4", "https://github.com/getkirby/kirby/releases/tag/5.4.4"], "fixes": ["4.9.4", "5.4.4"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-54005", "noindex": false, "published": "2026-07-09T18:47:02.487Z", "modified": "2026-07-14T01:14:10.573Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00427, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-54005", "title": "Kirby: `pages.access` permission is not checked in the `site/find` REST API route", "description": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenticated users who know or guess page IDs or UUIDs to retrieve page information, including full content and metadata, for arbitrary published pages through the /api/site/find route without authorization to access those pages. This issue is fixed in versions 4.9.4 and 5.4.4.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-r3w8-2c5r-h9j9", "https://github.com/getkirby/kirby/commit/a16dbd4329293c2c4b9a375d2badcb27c6337004", "https://github.com/getkirby/kirby/commit/b22d0b64b6478ce6871dc7ec3368d7afaf078688"], "fixes": ["4.9.4", "5.4.4"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-50188", "noindex": false, "published": "2026-07-09T18:44:56.901Z", "modified": "2026-07-09T19:20:56.407Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N", "severity": "medium", "epss": 0.00443, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-50188", "title": "Kirby: Request header injection in `Http\\Remote`", "description": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::request(), Remote::get(), and Remote::post(), to send outgoing HTTP requests with untrusted data in the headers option could allow newline characters in a header value to inject a separate unintended request header to the remote service. This issue is fixed in versions 4.9.4 and 5.4.4.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-4v4h-m2qq-ppgw", "https://github.com/getkirby/kirby/commit/aa33414e1669e866cdd6f4decfae2a669e8bb828", "https://github.com/getkirby/kirby/commit/fad9cbd22c73ed0fbd3aaf62310a8dcacfc007cd"], "fixes": ["4.9.4", "5.4.4"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-54004", "noindex": false, "published": "2026-07-09T18:42:00.680Z", "modified": "2026-07-09T19:48:01.785Z", "cvss": 6.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00496, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-54004", "title": "Kirby: Access to files of top-level drafts is not protected by permissions", "description": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents. This issue is fixed in versions 4.9.4 and 5.4.4.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-89cp-7p28-jffg", "https://github.com/getkirby/kirby/commit/5b9a0ed587575e39156d37fa42ca7f6c73e121f7", "https://github.com/getkirby/kirby/commit/bc721080cd8dd4dcb7fc20b3fd0460ee8d0603b0"], "fixes": ["4.9.4", "5.4.4"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-49274", "noindex": false, "published": "2026-07-09T18:38:32.436Z", "modified": "2026-07-14T01:10:30.223Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00484, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-49274", "title": "Kirby: `pages.access` permission is not checked in the pages picker for parent pages", "description": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission disabled allowed authenticated users to provide an inaccessible parent page or site to the page picker backend and confirm arbitrary page existence and retrieve title field values. This issue is fixed in versions 4.9.4 and 5.4.4.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-23q2-54qv-rq5x", "https://github.com/getkirby/kirby/commit/1ae575da24e1b1cb8803a031d37eff14606d7c55", "https://github.com/getkirby/kirby/commit/3bad37117adf2013548a784f820ddb2d8317333c"], "fixes": ["4.9.4", "5.4.4"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-54003", "noindex": false, "published": "2026-07-09T18:36:43.667Z", "modified": "2026-07-09T19:23:24.078Z", "cvss": 9.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "critical", "epss": 0.00743, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-54003", "title": "Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header", "description": "Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv", "https://github.com/getkirby/kirby/pull/8166", "https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d"], "fixes": ["4.9.4", "5.4.4"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-54002", "noindex": false, "published": "2026-07-09T18:34:29.041Z", "modified": "2026-07-09T19:26:59.702Z", "cvss": 8.5, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00547, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-54002", "title": "Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`", "description": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize(), Sane::sanitize(), Sane::Html::sanitize(), Sane::Svg::sanitize(), Sane::Xml::sanitize(), Sane::sanitizeFile(), or file sanitizeContents() with untrusted input allow malicious markup injected as children of an unknown HTML or XML tag to pass through Dom::sanitize() without being correctly sanitized, causing stored cross-site scripting. This issue is fixed in versions 4.9.4 and 5.4.4.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-wr9h-4r83-f4v6", "https://github.com/getkirby/kirby/commit/0f0437b5128c910103cbc78fc34d94b2a3faef4c", "https://github.com/getkirby/kirby/commit/7ad76cf9c7387462828e6ebfc8404e31b37829e9"], "fixes": ["4.9.4", "5.4.4"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-42174", "noindex": false, "published": "2026-05-09T03:39:06.016Z", "modified": "2026-05-11T17:41:44.554Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00237, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-42174", "title": "Kirby: User avatar creation, replacement and deletion are not gated by user update permissions", "description": "Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user update permissions. This issue has been patched in versions 4.9.0 and 5.4.0.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-39cp-6679-8xv2", "https://github.com/getkirby/kirby/releases/tag/4.9.0", "https://github.com/getkirby/kirby/releases/tag/5.4.0"], "fixes": ["4.9.0", "5.4.0"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-42137", "noindex": false, "published": "2026-05-09T03:38:35.474Z", "modified": "2026-05-12T02:21:50.789Z", "cvss": 7.1, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00303, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-42137", "title": "Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog", "description": "Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API. This issue has been patched in versions 4.9.0 and 5.4.0.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-85x2-r8xv-ww8c", "https://github.com/getkirby/kirby/releases/tag/4.9.0", "https://github.com/getkirby/kirby/releases/tag/5.4.0"], "fixes": ["4.9.0", "5.4.0"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}, {"id": "CVE-2026-42051", "noindex": false, "published": "2026-05-09T03:37:42.707Z", "modified": "2026-05-11T14:40:25.364Z", "cvss": 5.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00193, "kev": false, "exploits": [], "stacks": [{"name": "php", "path": "vulns/stack/php", "slug": "php"}], "path": "vulns/cve-2026-42051", "title": "Kirby: System API endpoint leaks license data and installed version to authenticated users", "description": "Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.", "references": ["https://github.com/getkirby/kirby/security/advisories/GHSA-x68m-c7jf-2572", "https://github.com/getkirby/kirby/releases/tag/4.9.0", "https://github.com/getkirby/kirby/releases/tag/5.4.0"], "fixes": ["4.9.0", "5.4.0"], "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}, {"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}]}], "total": 51, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "getkirby/cms", "path": "vulns/packagist/getkirby%2Fcms", "ecosystem": "Packagist"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": ["5.5.1", "5.5.0", "5.4.4", "5.4.3", "5.4.2", "5.4.1", "5.4.0", "5.3.3", "5.3.2", "5.3.1", "5.3.0-rc.1", "5.3.0"], "stats": {"recent": 0, "kev": 0}, "lastmod": "2026-09-03T18:02:09.849Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}