CVE-2026-40099

A vulnerability in the Kirby content management system allows a remote attacker to bypass local IP checks and install the Panel and create the first admin account. The issue affects versions prior to 4.9.4 and 5.4.4 when the server runs behind a reverse proxy that sets the Forwarded, X-Client-IP, or X-Real-IP request headers.

A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads to authorization bypass. The attack is possible to be carried out remotely. Upgrading to version 4.9.6 and 5.6.0 can resolve this issue. You should upgrade the affected component.

Kirby is an open-source content management system. Prior to versions 4.9.5 and 5.5.2, the media handler in src/Cms/Media.php allowed Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.

Kirby is an open-source CMS. Prior to 4.9.5 and 5.5.2, the media handler used incomplete filesystem containment checks, allowing access to files in sibling directories if the path shared a common prefix. A remote attacker could create and access thumbnails from image files in a sibling directory, potentially exposing staging sites, backups, or other internal sites.

Kirby is an open-source content management system. From version 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.

A vulnerability in the Kirby content management system prior to version 4.9.5 and from 5.0.0 through 5.5.1 causes the REST API error handler to return unsanitized PHP error messages, exposing the full filesystem path of the Kirby installation to unauthenticated API users. This affects all sites that have not disabled the REST API with the 'api' => false option. The issue is fixed in versions 4.9.5 and 5.5.2.

In Kirby CMS before versions 4.9.4 and 5.4.4, users with the pages.access permission disabled could retrieve full content and metadata of any published page via the /api/site/find endpoint by knowing page IDs or UUIDs. This vulnerability allowed unauthorized access to pages that should have been protected.

In Kirby (content management system) versions prior to 4.9.0 and 5.4.0, the `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API.

Kirby prior to versions 4.9.0 and 5.4.0 does not gate read access to site, user and role information by permissions, allowing unauthorized users to access this data.

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.