CVE-2026-69127Medium▾ SunlitKirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauth…
▾ Sunlit zone — Low / medium · no exploitation signal
impact 27.5 · likelihood 0.1 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.3%
Last analysed / modified upstream
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
getkirby/cms <= 4.9.4getkirby/cms >= 5.0.0, < 5.5.2Patched in:
getkirby/cms 4.9.5getkirby/cms 5.5.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75592MediumKirby is an open-source content management system
CVE-2026-75594HighKirby is an open-source content management system
CVE-2026-71415HighKirby is an open-source content management system
CVE-2026-49274MediumKirby: `pages.access` permission is not checked in the pages picker for parent pages
CVE-2026-49276HighKirby: Self cross-site scripting (self-XSS) in the writer field
CVE-2026-50188MediumKirby: Request header injection in `Http\Remote`