Executive brief
Kirby, an open-source content management system, contains a security flaw in how it handles user lookups. An attacker can exploit this to trick the system into loading unintended files or to map out the server's internal folder structure. This could lead to the exposure of sensitive configuration data or the execution of unauthorized code, potentially compromising the entire website.
Technical details
A path traversal vulnerability exists in Kirby CMS versions 5.3.0 through 5.4.0. The root cause is a performance optimization in the Users collection that lazily loads user objects by using a request-provided user ID to locate directories under 'site/accounts' without sufficient validation. An unauthenticated attacker can use '../' sequences in the authentication or users API to perform directory traversal. This can be leveraged to probe for the existence of directories (fingerprinting) or to trigger the inclusion of arbitrary 'index.php' files (such as those found in plugins), leading to potential remote code execution or information disclosure depending on the included file's logic. The issue is resolved in version 5.4.1 by validating the user ID format and ensuring path containment.
Affected products
- getkirby Kirby CMS >= 5.3.0, < 5.4.1
Timeline
- 2026-05-19: patched: Fixed in version 5.4.1
- 2026-05-19: advisory: GitHub Security Advisory GHSA-9hx7-c53c-v6x8 published
- 2026-07-16: disclosed: CVE-2026-44177 published to NVD