Junglewise Threat Intelligence

CVE-2026-54004: Kirby CMS missing authorization for draft files in clean file redirects

CVE-2026-54004 · Severity: medium · CVSS 4 · Published 2026-07-09

Technologies: Getkirby Kirby CMS, Kirby. Vendors: Kirby.

Executive brief

Kirby, a popular content management system, contains a vulnerability that could allow unauthorized visitors to access files attached to 'draft' pages before they are officially published. If a specific redirect feature is enabled, an attacker who knows the file's name could bypass security checks to view sensitive documents or images intended to be private. This could lead to the premature disclosure of confidential product launches, internal reports, or other sensitive media.

Technical details

A missing authorization check in Kirby CMS allows unauthenticated users to access files stored in top-level draft pages via 'clean file URLs' (e.g., /draft-page/image.jpg). When the 'content.fileRedirects' option is enabled, the system fails to verify page access permissions or preview tokens before redirecting the request to the physical media URL. This vulnerability specifically affects top-level drafts because clean file URLs for nested drafts are not currently supported by the CMS. An attacker must know or guess the specific URL of the draft page and file to exploit this. The issue has been resolved in Kirby 4.9.4 and 5.4.4 by implementing the same authorization logic used for draft page previews.

Affected products

  • getkirby Kirby CMS < 4.9.4, >= 5.0.0, < 5.4.4

Timeline

  • 2026-06-17: patched: Versions 4.9.4 and 5.4.4 released
  • 2026-06-17: advisory: GitHub Security Advisory published
  • 2026-07-09: disclosed: CVE-2026-54004 published to NVD

References

Related threats