Skip to contentGetkirby Kirby vulnerabilities
- getkirby kirbygetkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorizationCVE-2026-108924Public exploit5.3 Medium
- getkirby kirbyKirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handlingCVE-2026-75594Fix available8.2 High
- getkirby kirbyKirby: Access to image files outside of the site root via path traversal in the media handlingCVE-2026-75592Fix available6.9 Medium
- getkirby kirbyKirby: File upload permissions are not checked during processing of chunk dataCVE-2026-71415Fix available7.1 High
- getkirby kirbyKirby: System path exposure from error messages in the REST APICVE-2026-69127Fix available6.9 Medium
- getkirby kirbyKirby: `pages.access` permission is not checked in the `site/find` REST API routeCVE-2026-54005Fix available7.1 High
- getkirby kirbyKirby: Access to files of top-level drafts is not protected by permissionsCVE-2026-54004Fix available6.3 Medium
- getkirby kirbyKirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` headerCVE-2026-54003Fix available9.1 Critical
- getkirby kirbyKirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`CVE-2026-54002Fix available8.5 High
- getkirby kirbyKirby: Request header injection in `Http\Remote`CVE-2026-50188Fix available6.9 Medium
- getkirby kirbyKirby: Self cross-site scripting (self-XSS) in the writer fieldCVE-2026-49276Fix available7.4 High
- getkirby kirbyKirby: `pages.access` permission is not checked in the pages picker for parent pagesCVE-2026-49274Fix available5.3 Medium
- getkirby kirbyKirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontendCVE-2026-45368Fix available8.4 High
- getkirby kirbyKirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissionsCVE-2026-45334Fix available5.3 Medium
- getkirby kirbyKirby: Pre-authentication path traversal and PHP file inclusion during user lookupCVE-2026-44177Fix available8.8 High
- getkirby kirbyKirby: `pages.access` permission is not checked during rendering of page draftsCVE-2026-44176Fix available6.0 Medium
- getkirby kirbyKirby: Cross-site scripting (XSS) from list field content in the site frontendCVE-2026-44175Fix available8.5 High
- getkirby kirbyKirby: Arbitrary Method Call via REST API search and collection query endpointsCVE-2026-44174Fix available8.7 High
- getkirby kirbyKirby: System API endpoint leaks license data and installed version to authenticated usersCVE-2026-42051Fix available5.3 Medium
- getkirby kirbyKirby: User avatar creation, replacement and deletion are not gated by user update permissionsCVE-2026-42174Fix available5.3 Medium
- getkirby kirbyKirby: Read access to site, user and role information is not gated by permissionsCVE-2026-42069Fix available7.1 High
- getkirby kirbyKirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialogCVE-2026-42137Fix available7.1 High
- getkirby kirbyKirby is vulnerable to authorization bypass during page, file and user creation via blueprint injectionCVE-2026-41325Fix available7.1 High
- getkirby kirbyKirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameterCVE-2026-40099Fix available5.3 Medium
- getkirby kirbyKirby has Server-Side Template Injection (SSTI) via double template resolution in option renderingCVE-2026-34587Fix available7.6 High
- getkirby kirbyKirby has XML injection in its XML creator toolkitCVE-2026-32870Fix available6.9 Medium
- getkirby kirbyWithdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image UploadCVE-2026-299056.5 Medium
- getkirby kirbyKirby is missing permission checks in the content changes APICVE-2026-21896Fix available5.8 Medium
- getkirby kirbyKirby CMS has cross-site scripting (XSS) in the changes dialogCVE-2025-65012Fix available5.1 Medium
- getkirby kirbyPath traversal of collection names during file system lookupCVE-2025-31493Fix available6.3 Medium
- getkirby kirbyKirby vulnerable to path traversal in the router for PHP's built-in serverCVE-2025-30207Fix available2.3 Low
- getkirby kirbyKirby vulnerable to path traversal of snippet names in the `snippet()` helperCVE-2025-30159Fix available6.3 Medium
- getkirby kirbyInsufficient permission checks in the language settings in Kirby CMSCVE-2024-41964Fix available8.1 High
- getkirby kirbyKirby cross-site scripting (XSS) in the link field "Custom" typeCVE-2024-27087Fix available4.6 Medium
- getkirby kirbyA stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS...CVE-2024-26484Disputed6.1 Medium
- getkirby kirbyKirby vulnerable to unrestricted file upload of user avatar imagesCVE-2024-26483Fix available8.8 High
- getkirby kirby, kirby cms +1 moreWithdrawn Advisory: Kirby CMS HTML injection vulnerabilityCVE-2024-26482Disputed7.1 High
- getkirby kirbyKirby vulnerable to self cross-site scripting (self-XSS) in the URL fieldCVE-2024-26481Fix available4.7 Medium
- getkirby kirbyKirby vulnerable to denial of service from unlimited password lengthsCVE-2023-38492Fix available5.3 Medium
- getkirby kirbyKirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded filesCVE-2023-38491Fix available5.7 Medium
- getkirby kirbyKirby XML External Entity (XXE) vulnerability in the XML data handlerCVE-2023-38490Public exploitFix available6.8 Medium
- getkirby kirbyKirby vulnerable to Insufficient Session Expiration after a password changeCVE-2023-38489Fix available7.3 High
- getkirby kirbyKirby vulnerable to field injection in the KirbyData text storage handlerCVE-2023-38488Fix available7.1 High
- getkirby kirbyKirby CMS vulnerable to user enumeration in the brute force protectionCVE-2022-39315Fix available6.5 Medium
- getkirby kirbyUser enumeration in the code-based login and password reset formsCVE-2022-39314Fix available4.8 Medium
- getkirby kirbyCross-site scripting (XSS) from dynamic options in the multiselect field in KirbyCVE-2022-36037Fix available5.9 Medium
- getkirby kirbyKirby CMS 2.5.12 Cross-site Request ForgeryCVE-2018-145194.3 Medium
- getkirby kirbyKirby CMS 2.5.12 Cross-site ScriptingCVE-2018-145205.4 Medium
- getkirby kirbyCross-site scripting (XSS) from image block content in the site frontendCVE-2021-41258Fix available7.3 High
- getkirby kirbyCross-site scripting (XSS) from writer field content in the site frontendCVE-2021-41252Fix available7.3 High
- Show olderLoading…