---
id: CVE-2026-69127
title: Kirby is an open-source content management system
summary: >-
  Kirby is an open-source content management system. Prior to 4.9.5 and from
  5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP
  error messages that expose the full filesystem path of the Kirby installation
  to unauth…
severity: medium
cwe:
  - CWE-497
vendor: getkirby
product: getkirby/cms
affected:
  - getkirby/cms <= 4.9.4
  - 'getkirby/cms >= 5.0.0, < 5.5.2'
patched:
  - getkirby/cms 4.9.5
  - getkirby/cms 5.5.2
published: '2026-08-07'
updated: '2026-09-16'
sourceUpdated: '2026-09-16T13:42:42.113'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69127'
references:
  - url: >-
      https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0
    label: security-advisories@github.com
  - url: >-
      https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451
    label: security-advisories@github.com
  - url: 'https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-69127'
  - url: 'https://github.com/advisories/GHSA-rf2p-vh74-7vvh'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00507
epssPercentile: 0.40623
aliases:
  - GHSA-rf2p-vh74-7vvh
ecosystem: composer
ingestedAt: '2026-09-01T17:29:54.801Z'
---

## Overview

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-69127)

Affected packages:

- `getkirby/cms <= 4.9.4`
- `getkirby/cms >= 5.0.0, < 5.5.2`

Patched in:

- `getkirby/cms 4.9.5`
- `getkirby/cms 5.5.2`

Source: https://github.com/advisories/GHSA-rf2p-vh74-7vvh