CVE-2026-50188: Kirby CMS CRLF injection in Http Remote class

CVE-2026-50188 · Severity: medium · CVSS 4 · Published 2026-07-09

Kirby is an open-source content management system used to build and manage websites. A vulnerability in its internal HTTP request tool allows attackers to inject unauthorized headers into outgoing requests if the site or a plugin uses untrusted user data in those headers. This could allow an attacker to manipulate how the site communicates with external services, potentially leading to unauthorized access to those services or data tampering.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-50188 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-50188 being exploited in the wild.
How severe is CVE-2026-50188?
Medium severity, with a CVSS score of 4, published 9 July 2026.
Which products and versions are affected?
Kirby < 4.9.4, >= 5.0.0, < 5.4.4, <= 4.9.3, >= 5.0.0-alpha.1, <= 5.4.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.4.
Is there a fix for CVE-2026-50188?
Yes. getkirby/cms (Packagist): upgrade to 4.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-50188 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-50188?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.4 or later
    composer require getkirby/cms:^4.9.4

Technical details

A CRLF (Carriage Return Line Feed) injection vulnerability exists in the Kirby\Http\Remote class, specifically affecting methods like Remote::request(), Remote::get(), and Remote::post(). The root cause is a failure to sanitize newline characters (\r and \n) in header values before they are passed to the underlying cURL implementation. An attacker can exploit this by providing input containing these characters to any application or plugin that forwards user-controlled data into an outgoing request header. This allows the attacker to inject additional headers, potentially bypassing security controls on the remote service, such as Authorization or Host headers. The issue is fixed in versions 4.9.4 and 5.4.4 by stripping line breaks from header values.

Affected products

  • getkirby Kirby CMS < 4.9.4, >= 5.0.0, < 5.4.4

Identifiers

  • CVE-2026-50188
  • GHSA-4v4h-m2qq-ppgw

Timeline

  • 2026-06-17: patched: Fixes released in versions 4.9.4 and 5.4.4
  • 2026-06-17: advisory: GitHub Security Advisory published
  • 2026-07-09: disclosed: CVE-2026-50188 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.