Executive brief
Kirby is a popular open-source content management system used to power websites. The REST API is enabled by default on Kirby installations and provides programmatic access to content. When errors occur during API requests, the system was returning full server filesystem paths in error messages accessible to anyone, even without authentication. An attacker could exploit this path disclosure to map the server structure and prepare more targeted attacks, such as guessing default security salts or crafting exploits for known vulnerabilities in the exposed technology stack.
Technical details
The vulnerability is an information exposure flaw (CWE-497) in Kirby's REST API error handler. When processing API requests, PHP errors and general exceptions were converted to JSON responses without sanitizing sensitive path information. The error handler failed to strip absolute filesystem paths from error messages before returning them to API clients. In production mode (debug disabled), such detailed paths should not be exposed; however, in affected versions, paths were leaked regardless. An unauthenticated attacker can trigger PHP errors via malformed API requests and harvest system paths from the JSON error responses. This information can be used to infer the server's directory structure, guess default configuration values like content.salt, or tailor subsequent attacks. The fix, released in Kirby 4.9.5 and 5.5.2, hardens the error handler to only expose full messages for Kirby\Exception classes and replaces other errors with generic messages outside of debug mode, keeping paths relative to the Kirby installation root when in debug mode.
Affected products
- Kirby Kirby CMS <= 4.9.4, >= 5.0.0 and < 5.5.2
Timeline
- 2026-07-15: disclosed: Initially published as GitHub reviewed advisory
- 2026-09-01: advisory: Updated advisory published by GitHub (GHSA-rf2p-vh74-7vvh)
- 2026-09-01: patched: Patches available in Kirby 4.9.5 and 5.5.2