CVE-2026-69127: Kirby: System path exposure from error messages in the REST API

Severity: medium (CVSS 6.9 v4.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 0.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2026-08-07 · updated 2026-10-24
Weakness: CWE-497

Description

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.

Affected products

getkirby kirby: before 4.9.5; from 5.0.0, < 5.5.2

References

https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0
https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451
https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh

Get alerted when CVE-2026-69127 or the next vulnerability affects your stack