CVE-2026-44177: Kirby CMS path traversal and PHP file inclusion in user lookup

CVE-2026-44177 · Severity: high · CVSS 4 · Published 2026-07-16

Kirby, an open-source content management system, contains a security flaw in how it handles user lookups. An attacker can exploit this to trick the system into loading unintended files or to map out the server's internal folder structure. This could lead to the exposure of sensitive configuration data or the execution of unauthorized code, potentially compromising the entire website.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-44177 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-44177 being exploited in the wild.
How severe is CVE-2026-44177?
High severity, with a CVSS score of 4, published 16 July 2026.
Which products and versions are affected?
Kirby >= 5.3.0, < 5.4.1, >= 5.3.0, <= 5.4.0; getkirby/cms (Packagist) >= 5.3.0, <= 5.4.0, ECOSYSTEM:introduced=5.3.0,fixed=5.4.1.
Is there a fix for CVE-2026-44177?
Yes. getkirby/cms (Packagist): upgrade to 5.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-44177 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-44177?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 5.4.1 or later
    composer require getkirby/cms:^5.4.1

Technical details

A path traversal vulnerability exists in Kirby CMS versions 5.3.0 through 5.4.0. The root cause is a performance optimization in the Users collection that lazily loads user objects by using a request-provided user ID to locate directories under 'site/accounts' without sufficient validation. An unauthenticated attacker can use '../' sequences in the authentication or users API to perform directory traversal. This can be leveraged to probe for the existence of directories (fingerprinting) or to trigger the inclusion of arbitrary 'index.php' files (such as those found in plugins), leading to potential remote code execution or information disclosure depending on the included file's logic. The issue is resolved in version 5.4.1 by validating the user ID format and ensuring path containment.

Affected products

  • getkirby Kirby CMS >= 5.3.0, < 5.4.1

Identifiers

  • CVE-2026-44177
  • GHSA-9hx7-c53c-v6x8

Timeline

  • 2026-05-19: patched: Fixed in version 5.4.1
  • 2026-05-19: advisory: GitHub Security Advisory GHSA-9hx7-c53c-v6x8 published
  • 2026-07-16: disclosed: CVE-2026-44177 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.