getkirby Kirby

• CVE-2026-108924 Medium 4.3 getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization 0.3%
• CVE-2026-75594 High 8.2 Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling 0.8%
• CVE-2026-75592 Medium 6.9 Kirby: Access to image files outside of the site root via path traversal in the media handling 0.7%
• CVE-2026-71415 High 7.1 Kirby: File upload permissions are not checked during processing of chunk data 0.4%
• CVE-2026-69127 Medium 6.9 Kirby: System path exposure from error messages in the REST API 0.7%
• CVE-2026-45368 High 8.4 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend 0.5%
• CVE-2026-45334 Medium 5.3 Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions 0.4%
• CVE-2026-44175 High 8.5 Kirby: Cross-site scripting (XSS) from list field content in the site frontend 0.4%
• CVE-2026-44176 Medium 6.0 Kirby: `pages.access` permission is not checked during rendering of page drafts 0.4%
• CVE-2026-44177 High 8.8 Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup 1.8%
• CVE-2026-44174 High 8.7 Kirby: Arbitrary Method Call via REST API search and collection query endpoints 0.5%
• CVE-2026-49276 High 7.4 Kirby: Self cross-site scripting (self-XSS) in the writer field 0.4%
• CVE-2026-54005 High 7.1 Kirby: `pages.access` permission is not checked in the `site/find` REST API route 0.4%
• CVE-2026-50188 Medium 6.9 Kirby: Request header injection in `Http\Remote` 0.4%
• CVE-2026-54004 Medium 6.3 Kirby: Access to files of top-level drafts is not protected by permissions 0.5%
• CVE-2026-49274 Medium 5.3 Kirby: `pages.access` permission is not checked in the pages picker for parent pages 0.5%
• CVE-2026-54003 Critical 9.1 Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header 0.7%
• CVE-2026-54002 High 8.5 Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` 0.5%
• CVE-2026-42174 Medium 5.3 Kirby: User avatar creation, replacement and deletion are not gated by user update permissions 0.2%
• CVE-2026-42137 High 7.1 Kirby: `pages.access/list` and `files.access/list` permissions are not consistently checked in the REST API and changes dialog 0.3%
• CVE-2026-42051 Medium 5.3 Kirby: System API endpoint leaks license data and installed version to authenticated users 0.2%
• CVE-2026-42069 High 7.1 Kirby: Read access to site, user and role information is not gated by permissions 0.2%
• CVE-2026-41325 High 7.1 Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection 0.4%
• CVE-2026-40099 Medium 5.3 Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter 0.3%
• CVE-2026-34587 High 7.6 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering 0.3%
• CVE-2026-32870 Medium 6.9 Kirby has XML injection in its XML creator toolkit 0.3%
• CVE-2026-21896 Medium 5.8 Kirby is missing permission checks in the content changes API 0.2%
• CVE-2025-65012 Medium 5.1 Kirby CMS has cross-site scripting (XSS) in the changes dialog 0.2%
• CVE-2025-31493 Medium 6.3 Path traversal of collection names during file system lookup 0.6%
• CVE-2025-30207 Low 2.3 Kirby vulnerable to path traversal in the router for PHP's built-in server 0.6%
• CVE-2025-30159 Medium 6.3 Kirby vulnerable to path traversal of snippet names in the `snippet()` helper 0.7%
• CVE-2024-41964 High 8.1 Insufficient permission checks in the language settings in Kirby CMS 0.5%
• CVE-2024-27087 Medium 4.6 Kirby cross-site scripting (XSS) in the link field "Custom" type 0.3%
• CVE-2023-38492 Medium 5.3 Kirby vulnerable to denial of service from unlimited password lengths 1.2%
• CVE-2023-38491 Medium 5.7 Kirby vulnerable to Cross-site scripting (XSS) from MIME type auto-detection of uploaded files 0.6%
• CVE-2023-38490 Medium 6.8 Kirby XML External Entity (XXE) vulnerability in the XML data handler 1.7%
• CVE-2023-38489 High 7.3 Kirby vulnerable to Insufficient Session Expiration after a password change 0.8%
• CVE-2023-38488 High 7.1 Kirby vulnerable to field injection in the KirbyData text storage handler 0.9%
• CVE-2022-39315 Medium 6.5 Kirby CMS vulnerable to user enumeration in the brute force protection 0.8%
• CVE-2022-39314 Medium 4.8 User enumeration in the code-based login and password reset forms 0.4%
• CVE-2022-36037 Medium 5.9 Cross-site scripting (XSS) from dynamic options in the multiselect field in Kirby 0.9%
• CVE-2021-41258 High 7.3 Cross-site scripting (XSS) from image block content in the site frontend 0.8%
• CVE-2021-41252 High 7.3 Cross-site scripting (XSS) from writer field content in the site frontend 0.9%
• CVE-2021-32735 High 7.1 Cross-site scripting (XSS) from field and configuration text displayed in the Panel 0.5%
• CVE-2021-29460 High 7.6 Cross-site scripting (XSS) from unsanitized uploaded SVG files 3.2%
• CVE-2020-26255 Medium 6.8 PHP Phar archives could be uploaded and executed in Kirby 1.5%
• CVE-2020-26253 Medium 6.8 .dev domains treated as local in Kirby 0.6%