Skip to content
Getkirby vulnerabilities
Newest
-
getkirby kirby
getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization
CVE-2026-108924
Public exploit
5.3 Medium
-
getkirby kirby
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
CVE-2026-75594
Fix available
8.2 High
-
getkirby kirby
Kirby: Access to image files outside of the site root via path traversal in the media handling
CVE-2026-75592
Fix available
6.9 Medium
-
getkirby kirby
Kirby: File upload permissions are not checked during processing of chunk data
CVE-2026-71415
Fix available
7.1 High
-
getkirby kirby
Kirby: System path exposure from error messages in the REST API
CVE-2026-69127
Fix available
6.9 Medium
-
getkirby kirby
Kirby: `pages.access` permission is not checked in the `site/find` REST API route
CVE-2026-54005
Fix available
7.1 High
-
getkirby kirby
Kirby: Access to files of top-level drafts is not protected by permissions
CVE-2026-54004
Fix available
6.3 Medium
-
getkirby kirby
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
CVE-2026-54003
Fix available
9.1 Critical
-
getkirby kirby
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
CVE-2026-54002
Fix available
8.5 High
-
getkirby kirby
Kirby: Request header injection in `Http\Remote`
CVE-2026-50188
Fix available
6.9 Medium
-
getkirby kirby
Kirby: Self cross-site scripting (self-XSS) in the writer field
CVE-2026-49276
Fix available
7.4 High
-
getkirby kirby
Kirby: `pages.access` permission is not checked in the pages picker for parent pages
CVE-2026-49274
Fix available
5.3 Medium
-
getkirby kirby
Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
CVE-2026-45368
Fix available
8.4 High
-
getkirby kirby
Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
CVE-2026-45334
Fix available
5.3 Medium
-
getkirby kirby
Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup
CVE-2026-44177
Fix available
8.8 High
-
getkirby kirby
Kirby: `pages.access` permission is not checked during rendering of page drafts
CVE-2026-44176
Fix available
6.0 Medium
-
getkirby kirby
Kirby: Cross-site scripting (XSS) from list field content in the site frontend
CVE-2026-44175
Fix available
8.5 High
-
getkirby kirby
Kirby: Arbitrary Method Call via REST API search and collection query endpoints
CVE-2026-44174
Fix available
8.7 High
-
getkirby kirby
Kirby: System API endpoint leaks license data and installed version to authenticated users
CVE-2026-42051
Fix available
5.3 Medium
-
getkirby kirby
Kirby: User avatar creation, replacement and deletion are not gated by user update permissions
CVE-2026-42174
Fix available
5.3 Medium
-
getkirby kirby
Kirby: Read access to site, user and role information is not gated by permissions
CVE-2026-42069
Fix available
7.1 High
-
getkirby kirby
Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog
CVE-2026-42137
Fix available
7.1 High
-
getkirby kirby
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
CVE-2026-41325
Fix available
7.1 High
-
getkirby kirby
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
CVE-2026-40099
Fix available
5.3 Medium
-
getkirby kirby
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
CVE-2026-34587
Fix available
7.6 High
-
getkirby kirby
Kirby has XML injection in its XML creator toolkit
CVE-2026-32870
Fix available
6.9 Medium
-
getkirby kirby
Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload
CVE-2026-29905
6.5 Medium
-
getkirby kirby
Kirby is missing permission checks in the content changes API
CVE-2026-21896
Fix available
5.8 Medium
-
getkirby kirby
Kirby CMS has cross-site scripting (XSS) in the changes dialog
CVE-2025-65012
Fix available
5.1 Medium
-
getkirby kirby
Path traversal of collection names during file system lookup
CVE-2025-31493
Fix available
6.3 Medium
-
getkirby kirby
Kirby vulnerable to path traversal in the router for PHP's built-in server
CVE-2025-30207
Fix available
2.3 Low
-
getkirby kirby
Kirby vulnerable to path traversal of snippet names in the `snippet()` helper
CVE-2025-30159
Fix available
6.3 Medium
-
getkirby kirby
Insufficient permission checks in the language settings in Kirby CMS
CVE-2024-41964
Fix available
8.1 High
-
getkirby kirby
Kirby cross-site scripting (XSS) in the link field "Custom" type
CVE-2024-27087
Fix available
4.6 Medium
-
getkirby kirby
A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS...
CVE-2024-26484
Disputed
6.1 Medium
-
getkirby kirby
Kirby vulnerable to unrestricted file upload of user avatar images
CVE-2024-26483
Fix available
8.8 High
-
getkirby kirby, kirby cms +1 more
Withdrawn Advisory: Kirby CMS HTML injection vulnerability
CVE-2024-26482
Disputed
7.1 High
-
getkirby kirby
Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field
CVE-2024-26481
Fix available
4.7 Medium
-
getkirby kirby
Kirby vulnerable to denial of service from unlimited password lengths
CVE-2023-38492
Fix available
5.3 Medium
-
getkirby kirby
Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files
CVE-2023-38491
Fix available
5.7 Medium
-
getkirby kirby
Kirby XML External Entity (XXE) vulnerability in the XML data handler
CVE-2023-38490
Public exploitFix available
6.8 Medium
-
getkirby kirby
Kirby vulnerable to Insufficient Session Expiration after a password change
CVE-2023-38489
Fix available
7.3 High
-
getkirby kirby
Kirby vulnerable to field injection in the KirbyData text storage handler
CVE-2023-38488
Fix available
7.1 High
-
bastianallgeier kirby webmentions plugin, getkirby webmentions +1 more
bastianallgeier Kirby Webmentions Plugin injection
CVE-2017-20174
5.6 Medium
-
getkirby kirby
Kirby CMS vulnerable to user enumeration in the brute force protection
CVE-2022-39315
Fix available
6.5 Medium
-
getkirby kirby
User enumeration in the code-based login and password reset forms
CVE-2022-39314
Fix available
4.8 Medium
-
getkirby kirby
Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby
CVE-2022-36037
Fix available
5.9 Medium
-
getkirby kirby
Kirby CMS 2.5.12 Cross-site Request Forgery
CVE-2018-14519
4.3 Medium
-
getkirby kirby
Kirby CMS 2.5.12 Cross-site Scripting
CVE-2018-14520
5.4 Medium
-
getkirby starterkit
Cross site scripting in getkirby/starterkit
CVE-2022-35174
5.4 Medium
- Show olderLoading…