Vulnerabilities

TI-2026-30499 CVE-2026-42174 · GHSA-39cp-6679-8xv2

Kirby: User avatar creation, replacement and deletion are not gated by user update permissions

LOW 24

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00237 Published 2026-05-09 Fixed in 4.9.0, 5.4.0 CWE-862

TI-2026-30469 CVE-2026-42137 · GHSA-85x2-r8xv-ww8c

Missing authorization in getkirby kirby

LOW 31

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00303 Published 2026-05-09 Fixed in 4.9.0, 5.4.0 CWE-862

TI-2026-30430 CVE-2026-42051 · GHSA-x68m-c7jf-2572

Kirby: System API endpoint leaks license data and installed version to authenticated users

LOW 23

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-05-09 Fixed in 4.9.0, 5.4.0 CWE-862

TI-2026-30437 CVE-2026-42069 · GHSA-2h7v-4372-f6x2

Kirby: Read access to site, user and role information is not gated by permissions

LOW 31

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00231 Published 2026-05-09 Fixed in 4.9.0, 5.4.0 CWE-862

TI-2026-29926 CVE-2026-41325 · GHSA-6gqr-mx34-wh8r

Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

LOW 37

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00363 Published 2026-04-24 Fixed in 4.9.0, 5.4.0 CWE-863

TI-2026-28926 CVE-2026-40099 · GHSA-w942-j9r6-hr6r

Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

LOW 24

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00275 Published 2026-04-24 Fixed in 4.9.0, 5.4.0 CWE-863

TI-2026-26834 CVE-2026-34587 · GHSA-jcjw-58rv-c452

Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

LOW 35

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00334 Published 2026-04-24 Fixed in 4.9.0, 5.4.0 CWE-1336

TI-2026-25331 CVE-2026-32870 · GHSA-9wfj-c55w-j9qr

Kirby has XML injection in its XML creator toolkit

LOW 30

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00346 Published 2026-04-24 Fixed in 4.9.0, 5.4.0 CWE-91

TI-2026-23396 CVE-2026-29905

Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a…

MEDIUM 62

Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.

CVSS 3.1MEDIUM 6.5 Network Low privileges No interaction EPSS 0.00463 Published 2026-03-26 No fix listed CWE-20

TI-2026-17596 CVE-2026-21896 · GHSA-4j78-4xrm-cr2f

Kirby is missing permission checks in the content changes API

LOW 26

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.8 Network Low privileges User interaction EPSS 0.0023 Published 2026-01-08 Fixed in 5.2.2 CWE-863

TI-2025-40199 CVE-2025-65012 · GHSA-84hf-8gh5-575j

Kirby CMS has cross-site scripting (XSS) in the changes dialog

LOW 23

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.1 Network Low privileges User interaction EPSS 0.00196 Published 2025-11-18 Fixed in 5.1.4 CWE-79

TI-2025-22674 CVE-2025-31493 · GHSA-x275-h9j4-7p4h

Path traversal of collection names during file system lookup

LOW 29

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.0059 Published 2025-05-13 Fixed in 3.9.8.3, 3.10.1.2 +1 CWE-22

TI-2025-21543 CVE-2025-30207 · GHSA-9p3p-w5jf-8xxg

Kirby vulnerable to path traversal in the router for PHP's built-in server

LOW 13

Kirby is an open-source content management system.

CVSS 4.0LOW 2.3 Adjacent network No auth No interaction EPSS 0.00588 Published 2025-05-13 Fixed in 3.9.8.3, 3.10.1.2 +1 CWE-22

TI-2025-21498 CVE-2025-30159 · GHSA-fw82-87p8-v6hp

Kirby vulnerable to path traversal of snippet names in the `snippet()` helper

LOW 29

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00714 Published 2025-05-13 Fixed in 3.9.8.3, 3.10.1.2 +1 CWE-22

TI-2024-27985 CVE-2024-41964 · GHSA-jm9m-rqr3-wfmh

Insufficient permission checks in the language settings in Kirby CMS

LOW 36

Kirby is a CMS targeting designers and editors.

CVSS 3.1HIGH 8.1 Network Low privileges No interaction EPSS 0.0048 Published 2024-08-29 Fixed in 3.6.6.6, 3.7.5.5 +4 CWE-863

TI-2024-17949 CVE-2024-27087 · GHSA-63h4-w25c-3qv4

Kirby cross-site scripting (XSS) in the link field "Custom" type

LOW 24

Kirby is a content management system.

CVSS 3.1MEDIUM 5.4 Network Low privileges User interaction EPSS 0.00348 Published 2024-02-26 Fixed in 4.1.1 CWE-79

TI-2024-17441 CVE-2024-26484 · GHSA-754f-f3pv-5vpq

A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of…

MEDIUM 60

A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Link field.

CVSS 3.1MEDIUM 6.1 Network No auth User interaction EPSS 0.00429 Published 2024-02-22 No fix listed CWE-79

TI-2024-17440 CVE-2024-26483 · GHSA-xrvh-rvc4-5m43

An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0…

HIGH 73

An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.

CVSS 3.1HIGH 8.8 Network No auth User interaction EPSS 0.00966 Published 2024-02-22 Fixed in 3.6.6.5, 3.7.5.4 +4 CWE-94

TI-2024-17439 CVE-2024-26482

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS…

HIGH 66

An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0.

CVSS 3.1HIGH 7.1 Local Low privileges No interaction EPSS 0.0032 Published 2024-02-22 No fix listed CWE-80

TI-2024-17438 CVE-2024-26481 · GHSA-57f2-8p89-66x6

Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.

MEDIUM 55

Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter.

CVSS 3.1MEDIUM 4.7 Network No auth User interaction EPSS 0.00405 Published 2024-02-22 Fixed in 3.6.6.5, 3.7.5.4 +4 CWE-79

TI-2023-19872 CVE-2023-38492 · GHSA-3v6j-v3qc-cxff

Kirby vulnerable to denial of service from unlimited password lengths

MEDIUM 41

Kirby is a content management system.

CVSS 3.1HIGH 7.5 Network No auth No interaction EPSS 0.01178 Published 2023-07-27 Fixed in 3.5.8.3, 3.6.6.3 +4 CWE-770

TI-2023-19871 CVE-2023-38491 · GHSA-8fv7-wq38-f5c9

Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files

LOW 27

Kirby is a content management system.

CVSS 3.1MEDIUM 5.7 Network Low privileges User interaction EPSS 0.0062 Published 2023-07-27 Fixed in 3.5.8.3, 3.6.6.3 +4 CWE-79

TI-2023-19870 CVE-2023-38490 · GHSA-q386-w6fg-gmgp

Kirby XML External Entity (XXE) vulnerability in the XML data handler

MEDIUM 46

Kirby is a content management system.

CVSS 3.1CRITICAL 10.0 Network No auth No interaction EPSS 0.01701 Published 2023-07-27 Fixed in 3.5.8.3, 3.6.6.3 +4 CWE-611

TI-2023-19869 CVE-2023-38489 · GHSA-5mvj-rvp8-rf45

Kirby vulnerable to Insufficient Session Expiration after a password change

LOW 36

Kirby is a content management system.

CVSS 3.1HIGH 7.3 Network Low privileges User interaction EPSS 0.00809 Published 2023-07-27 Fixed in 3.5.8.3, 3.6.6.3 +4 CWE-613

TI-2023-19868 CVE-2023-38488 · GHSA-x5mr-p6v4-wp93

Kirby vulnerable to field injection in the KirbyData text storage handler

MEDIUM 40

Kirby is a content management system.

CVSS 3.1HIGH 8.8 Network Low privileges No interaction EPSS 0.00924 Published 2023-07-27 Fixed in 3.5.8.3, 3.6.6.3 +4 CWE-140

Vulnerabilities

Filters