Vulnerabilities

Filters

1 selected

62 records

Sort

Vendor: getkirby Clear all filters

TI-2026-71262 CVE-2026-108924 · GHSA-crvc-58c5-p9vq

Authorization bypass in Kirby dynamic option generation

LOW 24

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00307 Published 2026-10-12 Fixed in 4.9.6, 5.6.0 CWE-285

TI-2026-52904 CVE-2026-75594 · GHSA-9vx2-j98c-p72w

Path traversal in getkirby kirby

LOW 37

Kirby is an open-source content management system.

CVSS 4.0HIGH 8.2 Network No auth No interaction EPSS 0.00762 Published 2026-08-31 Fixed in 4.9.5, 5.5.2 CWE-22

TI-2026-52902 CVE-2026-75592 · GHSA-6j4c-mgqr-qv76

Kirby: Access to image files outside of the site root via path traversal in the media handling

LOW 32

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00676 Published 2026-08-31 Fixed in 4.9.5, 5.5.2 CWE-22

TI-2026-50044 CVE-2026-71415 · GHSA-67mx-6wf2-92xp

Kirby: File upload permissions are not checked during processing of chunk data

LOW 32

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00427 Published 2026-08-31 Fixed in 5.5.2 CWE-862

TI-2026-48525 CVE-2026-69127 · GHSA-rf2p-vh74-7vvh

Kirby: System path exposure from error messages in the REST API

LOW 38

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00699 Published 2026-08-07 Fixed in 4.9.5, 5.5.2 CWE-497

TI-2026-33159 CVE-2026-45368 · GHSA-qvjf-922g-pj44

Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

LOW 37

Kirby is an open-source content management system.

CVSS 4.0HIGH 8.4 Network Low privileges User interaction EPSS 0.00534 Published 2026-07-16 Fixed in 4.9.1, 5.4.1 CWE-79

TI-2026-33130 CVE-2026-45334 · GHSA-39vq-49qm-r2mc

Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions

LOW 24

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-16 Fixed in 4.9.1, 5.4.1 CWE-862

TI-2026-32155 CVE-2026-44175 · GHSA-5fhx-9q32-q257

Kirby: Cross-site scripting (XSS) from list field content in the site frontend

LOW 39

Kirby is an open-source content management system.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.0043 Published 2026-07-16 Fixed in 4.9.1, 5.4.1 CWE-79

TI-2026-32156 CVE-2026-44176 · GHSA-2xw4-v2wx-hqq9

Kirby: `pages.access` permission is not checked during rendering of page drafts

LOW 27

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 6.0 Network Low privileges No interaction EPSS 0.00364 Published 2026-07-16 Fixed in 4.9.1, 5.4.1 CWE-862

TI-2026-32157 CVE-2026-44177 · GHSA-9hx7-c53c-v6x8

Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup

MEDIUM 48

Kirby is an open-source content management system.

CVSS 4.0HIGH 8.8 Network No auth No interaction EPSS 0.0177 Published 2026-07-16 Fixed in 5.4.1 CWE-22

TI-2026-32154 CVE-2026-44174 · GHSA-86rh-h242-j8xp

Kirby: Arbitrary Method Call via REST API search and collection query endpoints

MEDIUM 40

Kirby is an open-source content management system.

CVSS 4.0HIGH 8.7 Network Low privileges No interaction EPSS 0.00487 Published 2026-07-16 Fixed in 4.9.1, 5.4.1 CWE-470

TI-2026-36465 CVE-2026-49276 · GHSA-rhj6-r49h-5932

Kirby: Self cross-site scripting (self-XSS) in the writer field

LOW 35

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.4 Network No auth User interaction EPSS 0.00432 Published 2026-07-09 Fixed in 4.9.4, 5.4.4 CWE-83

TI-2026-38954 CVE-2026-54005 · GHSA-r3w8-2c5r-h9j9

Kirby: `pages.access` permission is not checked in the `site/find` REST API route

LOW 32

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00427 Published 2026-07-09 Fixed in 4.9.4, 5.4.4 CWE-862

TI-2026-36947 CVE-2026-50188 · GHSA-4v4h-m2qq-ppgw

Kirby: Request header injection in `Http\Remote`

LOW 31

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 6.9 Network No auth No interaction EPSS 0.00443 Published 2026-07-09 Fixed in 4.9.4, 5.4.4 CWE-113

TI-2026-38953 CVE-2026-54004 · GHSA-89cp-7p28-jffg

Kirby: Access to files of top-level drafts is not protected by permissions

LOW 29

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 6.3 Network No auth No interaction EPSS 0.00496 Published 2026-07-09 Fixed in 4.9.4, 5.4.4 CWE-862

TI-2026-36464 CVE-2026-49274 · GHSA-23q2-54qv-rq5x

Kirby: `pages.access` permission is not checked in the pages picker for parent pages

LOW 25

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00484 Published 2026-07-09 Fixed in 4.9.4, 5.4.4 CWE-862

TI-2026-38952 CVE-2026-54003 · GHSA-whxw-24jc-cwmv

Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

MEDIUM 47

Kirby is an open-source content management system.

CVSS 4.0CRITICAL 9.1 Network No auth No interaction EPSS 0.00743 Published 2026-07-09 Fixed in 4.9.4, 5.4.4 CWE-454

TI-2026-38951 CVE-2026-54002 · GHSA-wr9h-4r83-f4v6

Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`

MEDIUM 40

Kirby is an open-source content management system.

CVSS 4.0HIGH 8.5 Network Low privileges User interaction EPSS 0.00547 Published 2026-07-09 Fixed in 4.9.4, 5.4.4 CWE-79

TI-2026-30499 CVE-2026-42174 · GHSA-39cp-6679-8xv2

Kirby: User avatar creation, replacement and deletion are not gated by user update permissions

LOW 24

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00237 Published 2026-05-09 Fixed in 4.9.0, 5.4.0 CWE-862

TI-2026-30469 CVE-2026-42137 · GHSA-85x2-r8xv-ww8c

Missing authorization in getkirby kirby

LOW 31

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00303 Published 2026-05-09 Fixed in 4.9.0, 5.4.0 CWE-862

TI-2026-30430 CVE-2026-42051 · GHSA-x68m-c7jf-2572

Kirby: System API endpoint leaks license data and installed version to authenticated users

LOW 23

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00193 Published 2026-05-09 Fixed in 4.9.0, 5.4.0 CWE-862

TI-2026-30437 CVE-2026-42069 · GHSA-2h7v-4372-f6x2

Kirby: Read access to site, user and role information is not gated by permissions

LOW 31

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00231 Published 2026-05-09 Fixed in 4.9.0, 5.4.0 CWE-862

TI-2026-29926 CVE-2026-41325 · GHSA-6gqr-mx34-wh8r

Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

LOW 37

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.1 Network Low privileges No interaction EPSS 0.00363 Published 2026-04-24 Fixed in 4.9.0, 5.4.0 CWE-863

TI-2026-28926 CVE-2026-40099 · GHSA-w942-j9r6-hr6r

Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter

LOW 24

Kirby is an open-source content management system.

CVSS 4.0MEDIUM 5.3 Network Low privileges No interaction EPSS 0.00275 Published 2026-04-24 Fixed in 4.9.0, 5.4.0 CWE-863

TI-2026-26834 CVE-2026-34587 · GHSA-jcjw-58rv-c452

Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering

LOW 35

Kirby is an open-source content management system.

CVSS 4.0HIGH 7.6 Network Low privileges No interaction EPSS 0.00334 Published 2026-04-24 Fixed in 4.9.0, 5.4.0 CWE-1336