CVE-2026-69127: Kirby REST API information disclosure via error messages

CVE-2026-69127 · Severity: medium · CVSS 4 · Published 2026-08-07

Kirby is a popular open-source content management system used to power websites. The REST API is enabled by default on Kirby installations and provides programmatic access to content. When errors occur during API requests, the system was returning full server filesystem paths in error messages accessible to anyone, even without authentication. An attacker could exploit this path disclosure to map the server structure and prepare more targeted attacks, such as guessing default security salts or crafting exploits for known vulnerabilities in the exposed technology stack.

Technologies: Kirby, getkirby/cms (Packagist). Vendors: Kirby, Packagist.

Quick answers

Is CVE-2026-69127 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-69127 being exploited in the wild.
How severe is CVE-2026-69127?
Medium severity, with a CVSS score of 4, published 7 August 2026.
Which products and versions are affected?
Kirby <= 4.9.4, >= 5.0.0 and < 5.5.2; getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.5.
Is there a fix for CVE-2026-69127?
Yes. getkirby/cms (Packagist): upgrade to 4.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-69127 attacked?
It is attacked over the network, in a web application.
Am I affected by CVE-2026-69127?
Check whether you run Kirby or getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.5 or later
    composer require getkirby/cms:^4.9.5

Technical details

The vulnerability is an information exposure flaw (CWE-497) in Kirby's REST API error handler. When processing API requests, PHP errors and general exceptions were converted to JSON responses without sanitizing sensitive path information. The error handler failed to strip absolute filesystem paths from error messages before returning them to API clients. In production mode (debug disabled), such detailed paths should not be exposed; however, in affected versions, paths were leaked regardless. An unauthenticated attacker can trigger PHP errors via malformed API requests and harvest system paths from the JSON error responses. This information can be used to infer the server's directory structure, guess default configuration values like content.salt, or tailor subsequent attacks. The fix, released in Kirby 4.9.5 and 5.5.2, hardens the error handler to only expose full messages for Kirby\Exception classes and replaces other errors with generic messages outside of debug mode, keeping paths relative to the Kirby installation root when in debug mode.

Affected products

  • Kirby Kirby CMS <= 4.9.4, >= 5.0.0 and < 5.5.2

Identifiers

  • CVE-2026-69127
  • GHSA-rf2p-vh74-7vvh

Timeline

  • 2026-07-15: disclosed: Initially published as GitHub reviewed advisory
  • 2026-09-01: advisory: Updated advisory published by GitHub (GHSA-rf2p-vh74-7vvh)
  • 2026-09-01: patched: Patches available in Kirby 4.9.5 and 5.5.2

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.