# CVE-2026-44177: Kirby CMS path traversal and PHP file inclusion in user lookup

Source: https://junglewise.ai/threats/cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-16. Updated: 2026-07-16  
License: CC BY 4.0 with a link back

CVE-2026-44177 · Severity: high · CVSS 4 · Published 2026-07-16

Kirby, an open-source content management system, contains a security flaw in how it handles user lookups. An attacker can exploit this to trick the system into loading unintended files or to map out the server's internal folder structure. This could lead to the exposure of sensitive configuration data or the execution of unauthorized code, potentially compromising the entire website.

Technologies: [Kirby](https://junglewise.ai/threats/technologies/kirby), [getkirby/cms (Packagist)](https://junglewise.ai/threats/technologies/getkirby-cms). Vendors: [Kirby](https://junglewise.ai/threats/vendors/kirby), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-44177 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-44177 being exploited in the wild.

**How severe is CVE-2026-44177?** High severity, with a CVSS score of 4, published 16 July 2026.

**Which products and versions are affected?** Kirby >= 5.3.0, < 5.4.1, >= 5.3.0, <= 5.4.0; getkirby/cms (Packagist) >= 5.3.0, <= 5.4.0, ECOSYSTEM:introduced=5.3.0,fixed=5.4.1.

**Is there a fix for CVE-2026-44177?** Yes. getkirby/cms (Packagist): upgrade to 5.4.1 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-44177 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-44177?** Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getkirby/cms (Packagist): upgrade to 5.4.1 or later

  ```sh
  composer require getkirby/cms:^5.4.1
  ```


## Technical details

A path traversal vulnerability exists in Kirby CMS versions 5.3.0 through 5.4.0. The root cause is a performance optimization in the Users collection that lazily loads user objects by using a request-provided user ID to locate directories under 'site/accounts' without sufficient validation. An unauthenticated attacker can use '../' sequences in the authentication or users API to perform directory traversal. This can be leveraged to probe for the existence of directories (fingerprinting) or to trigger the inclusion of arbitrary 'index.php' files (such as those found in plugins), leading to potential remote code execution or information disclosure depending on the included file's logic. The issue is resolved in version 5.4.1 by validating the user ID format and ensuring path containment.

## Affected products

- getkirby Kirby CMS >= 5.3.0, < 5.4.1

## Identifiers

- CVE-2026-44177
- GHSA-9hx7-c53c-v6x8

## Timeline

- 2026-05-19: patched: Fixed in version 5.4.1
- 2026-05-19: advisory: GitHub Security Advisory GHSA-9hx7-c53c-v6x8 published
- 2026-07-16: disclosed: CVE-2026-44177 published to NVD

## References

- [https://github.com/getkirby/kirby/releases/tag/5.4.1](https://github.com/getkirby/kirby/releases/tag/5.4.1)
- [https://github.com/getkirby/kirby/security/advisories/GHSA-9hx7-c53c-v6x8](https://github.com/getkirby/kirby/security/advisories/GHSA-9hx7-c53c-v6x8)

## Related threats

- [Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes)
- [Kirby path traversal in media handling via sibling directory bypass](https://junglewise.ai/threats/cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory)
- [Kirby authorization bypass in REST API file uploads](https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads)
- [Kirby REST API information disclosure via error messages](https://junglewise.ai/threats/cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages)
- [Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags)