# CVE-2026-54004: Kirby CMS missing authorization for draft files in clean file redirects

Source: https://junglewise.ai/threats/cve-2026-54004-kirby-cms-missing-authorization-for-draft-files-in-clean-file  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-09. Updated: 2026-07-09  
License: CC BY 4.0 with a link back

CVE-2026-54004 · Severity: medium · CVSS 4 · Published 2026-07-09

Kirby, a popular content management system, contains a vulnerability that could allow unauthorized visitors to access files attached to 'draft' pages before they are officially published. If a specific redirect feature is enabled, an attacker who knows the file's name could bypass security checks to view sensitive documents or images intended to be private. This could lead to the premature disclosure of confidential product launches, internal reports, or other sensitive media.

Technologies: [Kirby](https://junglewise.ai/threats/technologies/kirby), [getkirby/cms (Packagist)](https://junglewise.ai/threats/technologies/getkirby-cms). Vendors: [Kirby](https://junglewise.ai/threats/vendors/kirby), [Packagist](https://junglewise.ai/threats/vendors/packagist).

## Quick answers

**Is CVE-2026-54004 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-54004 being exploited in the wild.

**How severe is CVE-2026-54004?** Medium severity, with a CVSS score of 4, published 9 July 2026.

**Which products and versions are affected?** Kirby < 4.9.4, >= 5.0.0, < 5.4.4, <= 4.9.3, >= 5.0.0-alpha.1, <= 5.4.3; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.4.

**Is there a fix for CVE-2026-54004?** Yes. getkirby/cms (Packagist): upgrade to 4.9.4 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-54004 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-54004?** Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- getkirby/cms (Packagist): upgrade to 4.9.4 or later

  ```sh
  composer require getkirby/cms:^4.9.4
  ```


## Technical details

A missing authorization check in Kirby CMS allows unauthenticated users to access files stored in top-level draft pages via 'clean file URLs' (e.g., /draft-page/image.jpg). When the 'content.fileRedirects' option is enabled, the system fails to verify page access permissions or preview tokens before redirecting the request to the physical media URL. This vulnerability specifically affects top-level drafts because clean file URLs for nested drafts are not currently supported by the CMS. An attacker must know or guess the specific URL of the draft page and file to exploit this. The issue has been resolved in Kirby 4.9.4 and 5.4.4 by implementing the same authorization logic used for draft page previews.

## Affected products

- getkirby Kirby CMS < 4.9.4, >= 5.0.0, < 5.4.4

## Identifiers

- CVE-2026-54004
- GHSA-89cp-7p28-jffg

## Timeline

- 2026-06-17: patched: Versions 4.9.4 and 5.4.4 released
- 2026-06-17: advisory: GitHub Security Advisory published
- 2026-07-09: disclosed: CVE-2026-54004 published to NVD

## References

- [https://github.com/getkirby/kirby/commit/5b9a0ed587575e39156d37fa42ca7f6c73e121f7](https://github.com/getkirby/kirby/commit/5b9a0ed587575e39156d37fa42ca7f6c73e121f7)
- [https://github.com/getkirby/kirby/commit/bc721080cd8dd4dcb7fc20b3fd0460ee8d0603b0](https://github.com/getkirby/kirby/commit/bc721080cd8dd4dcb7fc20b3fd0460ee8d0603b0)
- [https://github.com/getkirby/kirby/releases/tag/4.9.4](https://github.com/getkirby/kirby/releases/tag/4.9.4)
- [https://github.com/getkirby/kirby/releases/tag/5.4.4](https://github.com/getkirby/kirby/releases/tag/5.4.4)
- [https://github.com/getkirby/kirby/security/advisories/GHSA-89cp-7p28-jffg](https://github.com/getkirby/kirby/security/advisories/GHSA-89cp-7p28-jffg)

## Related threats

- [Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes)
- [Kirby path traversal in media handling via sibling directory bypass](https://junglewise.ai/threats/cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory)
- [Kirby authorization bypass in REST API file uploads](https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads)
- [Kirby REST API information disclosure via error messages](https://junglewise.ai/threats/cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages)
- [Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags)