Executive brief
Kirby, a content management system, is vulnerable to a flaw that allows authenticated users to execute unauthorized commands through the system's search and data collection features. An attacker with basic access to the management panel could exploit this to steal sensitive information like password hashes, delete website content, or escalate their own account privileges. This could lead to a full site takeover or significant data loss.
Technical details
Kirby's REST API endpoints for searching and querying collections (such as users, files, and pages) failed to validate the model attributes passed to methods like filter(), sort(), and findBy(). An attacker with 'Low' privileges (authenticated Panel user) can inject arbitrary model methods into these queries. Exploitation allows calling sensitive methods such as password() to retrieve hashes, root() to disclose server paths, loginPasswordless() for privilege escalation, or delete() to remove queried models. The fix, introduced in versions 4.9.1 and 5.4.1, implements a blocklist of sensitive methods and restricts query options for affected API endpoints.
Affected products
- getkirby Kirby CMS <= 4.9.0, 5.0.0-5.4.0
Timeline
- 2026-05-19: patched: Versions 4.9.1 and 5.4.1 released
- 2026-05-19: advisory: GitHub Security Advisory GHSA-86rh-h242-j8xp published
- 2026-07-16: disclosed: CVE-2026-44174 published to NVD