What’s Vulnerable › Products
getkirby kirby vulnerabilities
59 known vulnerabilities, 0 confirmed exploited in the wild (CISA KEV), 32 published in the last 12 months.
Check whether your getkirby kirby version is affected
Latest getkirby kirby vulnerabilities
- CVE-2026-108924 — getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization (CVSS 4.3)
- CVE-2026-75594 — Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling (CVSS 8.2)
- CVE-2026-75592 — Kirby: Access to image files outside of the site root via path traversal in the media handling (CVSS 6.9)
- CVE-2026-71415 — Kirby: File upload permissions are not checked during processing of chunk data (CVSS 7.1)
- CVE-2026-69127 — Kirby: System path exposure from error messages in the REST API (CVSS 6.9)
- CVE-2026-45368 — Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend (CVSS 8.4)
- CVE-2026-45334 — Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions (CVSS 5.3)
- CVE-2026-44177 — Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup (CVSS 8.8)
- CVE-2026-44176 — Kirby: `pages.access` permission is not checked during rendering of page drafts (CVSS 6.0)
- CVE-2026-44175 — Kirby: Cross-site scripting (XSS) from list field content in the site frontend (CVSS 8.5)
- CVE-2026-44174 — Kirby: Arbitrary Method Call via REST API search and collection query endpoints (CVSS 8.7)
- CVE-2026-54005 — Kirby: `pages.access` permission is not checked in the `site/find` REST API route (CVSS 7.1)
- CVE-2026-54004 — Kirby: Access to files of top-level drafts is not protected by permissions (CVSS 6.3)
- CVE-2026-54003 — Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header (CVSS 9.1)
- CVE-2026-54002 — Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` (CVSS 8.5)
- CVE-2026-50188 — Kirby: Request header injection in `Http\Remote` (CVSS 6.9)
- CVE-2026-49276 — Kirby: Self cross-site scripting (self-XSS) in the writer field (CVSS 7.4)
- CVE-2026-49274 — Kirby: `pages.access` permission is not checked in the pages picker for parent pages (CVSS 5.3)
- CVE-2026-42174 — Kirby: User avatar creation, replacement and deletion are not gated by user update permissions (CVSS 4.3)
- CVE-2026-42137 — Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog (CVSS 6.5)
- CVE-2026-42069 — Kirby: Read access to site, user and role information is not gated by permissions (CVSS 6.5)
- CVE-2026-42051 — Kirby: System API endpoint leaks license data and installed version to authenticated users (CVSS 4.3)
- CVE-2026-41325 — Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection (CVSS 8.8)
- CVE-2026-40099 — Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter (CVSS 6.5)
- CVE-2026-34587 — Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering (CVSS 8.1)