# getkirby/cms (Packagist) vulnerabilities Source: https://junglewise.ai/threats/technologies/getkirby-cms Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 9 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/technologies/getkirby-cms.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 55 vulnerabilities in getkirby/cms (Packagist): 0 in the last 7 days and 3 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-75594, was published on 31 August 2026. Nothing was published in the last eight weeks. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 3 - All time: 55 (1 critical, 0 exploited in the wild) ## About getkirby/cms (Packagist) Kirby is a flat-file content management system built with PHP. ## Latest getkirby/cms (Packagist) vulnerabilities - [CVE-2026-75594: Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes) (high, CVSS 4, published 31 Aug 2026) - [CVE-2026-75592: Kirby path traversal in media handling via sibling directory bypass](https://junglewise.ai/threats/cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory) (medium, CVSS 4, published 31 Aug 2026) - [CVE-2026-71415: Kirby authorization bypass in REST API file uploads](https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads) (high, CVSS 4, published 31 Aug 2026) - [CVE-2026-69127: Kirby REST API information disclosure via error messages](https://junglewise.ai/threats/cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages) (medium, CVSS 4, published 7 Aug 2026) - [CVE-2026-45368: Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-45334: Kirby CMS information disclosure in content-locking feature](https://junglewise.ai/threats/cve-2026-45334-kirby-cms-information-disclosure-in-content-locking-feature) (medium, CVSS 4, published 16 Jul 2026) - [CVE-2026-44177: Kirby CMS path traversal and PHP file inclusion in user lookup](https://junglewise.ai/threats/cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-44176: Kirby CMS missing authorization in page draft rendering](https://junglewise.ai/threats/cve-2026-44176-kirby-cms-missing-authorization-in-page-draft-rendering) (medium, CVSS 4, published 16 Jul 2026) - [CVE-2026-44175: Kirby CMS persistent XSS in list field](https://junglewise.ai/threats/cve-2026-44175-kirby-cms-persistent-xss-in-list-field) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-44174: Kirby CMS arbitrary method call in REST API collection queries](https://junglewise.ai/threats/cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-54005: Kirby CMS missing authorization in site/find API route](https://junglewise.ai/threats/cve-2026-54005-kirby-cms-missing-authorization-in-site-find-api-route) (high, CVSS 4, published 9 Jul 2026) - [CVE-2026-54004: Kirby CMS missing authorization for draft files in clean file redirects](https://junglewise.ai/threats/cve-2026-54004-kirby-cms-missing-authorization-for-draft-files-in-clean-file) (medium, CVSS 4, published 9 Jul 2026) - [CVE-2026-54003: Kirby CMS authentication bypass in Panel installation via header spoofing](https://junglewise.ai/threats/cve-2026-54003-kirby-cms-authentication-bypass-in-panel-installation-via-header) (critical, CVSS 4, published 9 Jul 2026) - [CVE-2026-54002: Kirby CMS stored XSS in Dom sanitization component](https://junglewise.ai/threats/cve-2026-54002-kirby-cms-stored-xss-in-dom-sanitization-component) (high, CVSS 4, published 9 Jul 2026) - [CVE-2026-50188: Kirby CMS CRLF injection in Http Remote class](https://junglewise.ai/threats/cve-2026-50188-kirby-cms-crlf-injection-in-http-remote-class) (medium, CVSS 4, published 9 Jul 2026) - [CVE-2026-49276: Kirby CMS self-XSS in writer field](https://junglewise.ai/threats/cve-2026-49276-kirby-cms-self-xss-in-writer-field) (high, CVSS 4, published 9 Jul 2026) - [CVE-2026-49274: Kirby CMS missing authorization in PagePicker component](https://junglewise.ai/threats/cve-2026-49274-kirby-cms-missing-authorization-in-pagepicker-component) (medium, CVSS 4, published 9 Jul 2026) - [CVE-2026-42174: Kirby CMS missing authorization for user avatar management](https://junglewise.ai/threats/cve-2026-42174-kirby-cms-missing-authorization-for-user-avatar-management) (medium, CVSS 4.3, published 9 May 2026) - [CVE-2026-42137: Kirby CMS incorrect authorization in Panel and REST API permissions](https://junglewise.ai/threats/cve-2026-42137-kirby-cms-incorrect-authorization-in-panel-and-rest-api) (medium, CVSS 6.5, published 9 May 2026) - [CVE-2026-42069: Kirby CMS missing authorization for site and user information](https://junglewise.ai/threats/cve-2026-42069-kirby-cms-missing-authorization-for-site-and-user-information) (high, CVSS 6.5, published 9 May 2026) - [CVE-2026-42051: Kirby CMS information disclosure in system API endpoint](https://junglewise.ai/threats/cve-2026-42051-kirby-cms-information-disclosure-in-system-api-endpoint) (medium, CVSS 4.3, published 9 May 2026) - [CVE-2026-41325: Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection](https://junglewise.ai/threats/cve-2026-41325-kirby-is-vulnerable-to-authorization-bypass-during-page-file-and) (high, CVSS 8.8, published 24 Apr 2026) - [CVE-2026-40099: Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter](https://junglewise.ai/threats/cve-2026-40099-kirby-s-page-creation-api-bypasses-the-changestatus-permission) (medium, CVSS 6.5, published 24 Apr 2026) - [CVE-2026-34587: Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering](https://junglewise.ai/threats/cve-2026-34587-kirby-has-server-side-template-injection-ssti-via-double-template) (high, CVSS 8.1, published 24 Apr 2026) - [CVE-2026-32870: Kirby has XML injection in its XML creator toolkit](https://junglewise.ai/threats/cve-2026-32870-kirby-has-xml-injection-in-its-xml-creator-toolkit) (high, CVSS 7.5, published 24 Apr 2026) ## Most severe getkirby/cms (Packagist) vulnerabilities - [CVE-2026-54003: Kirby CMS authentication bypass in Panel installation via header spoofing](https://junglewise.ai/threats/cve-2026-54003-kirby-cms-authentication-bypass-in-panel-installation-via-header) (critical, CVSS 4, published 9 Jul 2026) - [CVE-2026-41325: Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection](https://junglewise.ai/threats/cve-2026-41325-kirby-is-vulnerable-to-authorization-bypass-during-page-file-and) (high, CVSS 8.8, published 24 Apr 2026) - [CVE-2026-34587: Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering](https://junglewise.ai/threats/cve-2026-34587-kirby-has-server-side-template-injection-ssti-via-double-template) (high, CVSS 8.1, published 24 Apr 2026) - [CVE-2026-32870: Kirby has XML injection in its XML creator toolkit](https://junglewise.ai/threats/cve-2026-32870-kirby-has-xml-injection-in-its-xml-creator-toolkit) (high, CVSS 7.5, published 24 Apr 2026) - [CVE-2026-42069: Kirby CMS missing authorization for site and user information](https://junglewise.ai/threats/cve-2026-42069-kirby-cms-missing-authorization-for-site-and-user-information) (high, CVSS 6.5, published 9 May 2026) - [CVE-2026-44177: Kirby CMS path traversal and PHP file inclusion in user lookup](https://junglewise.ai/threats/cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-75594: Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes) (high, CVSS 4, published 31 Aug 2026) - [CVE-2026-54002: Kirby CMS stored XSS in Dom sanitization component](https://junglewise.ai/threats/cve-2026-54002-kirby-cms-stored-xss-in-dom-sanitization-component) (high, CVSS 4, published 9 Jul 2026) - [CVE-2026-45368: Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-44174: Kirby CMS arbitrary method call in REST API collection queries](https://junglewise.ai/threats/cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries) (high, CVSS 4, published 16 Jul 2026) ## Vulnerabilities per week Nothing was published in the last eight weeks. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 3 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 0 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Other Packagist technologies - [moodle/moodle (Packagist)](https://junglewise.ai/threats/technologies/moodle-moodle): 434 vulnerabilities - [magento/community-edition (Packagist)](https://junglewise.ai/threats/technologies/packagist-magento-community-edition): 362 vulnerabilities - [typo3/cms (Packagist)](https://junglewise.ai/threats/technologies/packagist-typo3-cms): 187 vulnerabilities - [wwbn/avideo (Packagist)](https://junglewise.ai/threats/technologies/wwbn-avideo): 164 vulnerabilities - [magento/project-community-edition (Packagist)](https://junglewise.ai/threats/technologies/magento-project-community-edition): 161 vulnerabilities - [drupal/core (Packagist)](https://junglewise.ai/threats/technologies/packagist-drupal-core): 150 vulnerabilities - [pimcore/pimcore (Packagist)](https://junglewise.ai/threats/technologies/pimcore-pimcore): 145 vulnerabilities - [craftcms/cms (Packagist)](https://junglewise.ai/threats/technologies/craftcms-cms): 143 vulnerabilities - [dolibarr/dolibarr (Packagist)](https://junglewise.ai/threats/technologies/dolibarr-dolibarr): 127 vulnerabilities - [getgrav/grav (Packagist)](https://junglewise.ai/threats/technologies/getgrav-grav): 127 vulnerabilities - [typo3/cms-core (Packagist)](https://junglewise.ai/threats/technologies/typo3-cms-core): 127 vulnerabilities - [concrete5/concrete5 (Packagist)](https://junglewise.ai/threats/technologies/concrete5-concrete5): 122 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "getkirby/cms (Packagist) vulnerabilities", https://junglewise.ai/threats/technologies/getkirby-cms, 9 November 2026.