Is CVE-2026-54004 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-54004 being exploited in the wild.

How severe is CVE-2026-54004?

Medium severity, with a CVSS score of 4, published 9 July 2026.

Which products and versions are affected?

Kirby = 5.0.0, = 5.0.0-alpha.1, <= 5.4.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.4.

Is there a fix for CVE-2026-54004?

Yes. getkirby/cms (Packagist): upgrade to 4.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-54004 attacked?

It is attacked over the network, in a web application.

Am I affected by CVE-2026-54004?

Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54004: Kirby CMS missing authorization for draft files in clean file redirects

Q: Is there a fix for CVE-2026-54004?

Yes. getkirby/cms (Packagist): upgrade to 4.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

Q: How is CVE-2026-54004 attacked?

It is attacked over the network, in a web application.

Q: Am I affected by CVE-2026-54004?

Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-54004 · Severity: medium · CVSS 4 · Published 2026-07-09

Kirby, a popular content management system, contains a vulnerability that could allow unauthorized visitors to access files attached to 'draft' pages before they are officially published. If a specific redirect feature is enabled, an attacker who knows the file's name could bypass security checks to view sensitive documents or images intended to be private. This could lead to the premature disclosure of confidential product launches, internal reports, or other sensitive media.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-54004 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-54004 being exploited in the wild.
How severe is CVE-2026-54004?: Medium severity, with a CVSS score of 4, published 9 July 2026.
Which products and versions are affected?: Kirby < 4.9.4, >= 5.0.0, < 5.4.4, <= 4.9.3, >= 5.0.0-alpha.1, <= 5.4.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.4.
Is there a fix for CVE-2026-54004?: Yes. getkirby/cms (Packagist): upgrade to 4.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-54004 attacked?: It is attacked over the network, in a web application.
Am I affected by CVE-2026-54004?: Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

getkirby/cms (Packagist): upgrade to 4.9.4 or later
```
composer require getkirby/cms:^4.9.4
```

Technical details

A missing authorization check in Kirby CMS allows unauthenticated users to access files stored in top-level draft pages via 'clean file URLs' (e.g., /draft-page/image.jpg). When the 'content.fileRedirects' option is enabled, the system fails to verify page access permissions or preview tokens before redirecting the request to the physical media URL. This vulnerability specifically affects top-level drafts because clean file URLs for nested drafts are not currently supported by the CMS. An attacker must know or guess the specific URL of the draft page and file to exploit this. The issue has been resolved in Kirby 4.9.4 and 5.4.4 by implementing the same authorization logic used for draft page previews.

Affected products

getkirby Kirby CMS < 4.9.4, >= 5.0.0, < 5.4.4

Identifiers

CVE-2026-54004
GHSA-89cp-7p28-jffg

Timeline

2026-06-17: patched: Versions 4.9.4 and 5.4.4 released
2026-06-17: advisory: GitHub Security Advisory published
2026-07-09: disclosed: CVE-2026-54004 published to NVD

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.