{"schema_version":1,"title":"Kirby CMS vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 17 vulnerabilities in Kirby CMS: 0 in the last 7 days and 13 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-69127, was published on 1 September 2026.","url":"https://junglewise.ai/threats/technologies/kirby-cms","json_url":"https://junglewise.ai/threats/technologies/kirby-cms.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/technologies/kirby-cms","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"technology","counts":{"high":8,"all_time":17,"critical":0,"exploited":0,"last_7_days":0,"last_30_days":3,"last_90_days":13,"last_365_days":17},"latest":[{"cve":"CVE-2026-69127","cvss":6.9,"epss":0.0051,"slug":"cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages","title":"Kirby REST API information disclosure via error messages","severity":"medium","exploited":false,"published_at":"2026-09-01T16:37:47+00:00","url":"https://junglewise.ai/threats/cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages"},{"cve":"CVE-2026-75594","cvss":8.2,"epss":0.0076,"slug":"cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes","title":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms","severity":"high","exploited":false,"published_at":"2026-08-31T21:17:48.76+00:00","url":"https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes"},{"cve":"CVE-2026-75592","cvss":6.9,"epss":0.0068,"slug":"cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory","title":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incom","severity":"medium","exploited":false,"published_at":"2026-08-31T21:17:48.613+00:00","url":"https://junglewise.ai/threats/cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory"},{"cve":"CVE-2026-45368","cvss":8.4,"slug":"cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags","title":"Kirby CMS stored XSS via dangerous URL schemes in KirbyTags","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:02.68+00:00","url":"https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags"},{"cve":"CVE-2026-45334","cvss":5.3,"slug":"cve-2026-45334-kirby-cms-information-disclosure-in-content-locking-feature","title":"Kirby CMS information disclosure in content-locking feature","severity":"medium","exploited":false,"published_at":"2026-07-16T22:17:02.55+00:00","url":"https://junglewise.ai/threats/cve-2026-45334-kirby-cms-information-disclosure-in-content-locking-feature"},{"cve":"CVE-2026-44177","cvss":8.8,"slug":"cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup","title":"Kirby CMS path traversal and PHP file inclusion in user lookup","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:02.103+00:00","url":"https://junglewise.ai/threats/cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup"},{"cve":"CVE-2026-44176","cvss":6,"slug":"cve-2026-44176-kirby-cms-missing-authorization-in-page-draft-rendering","title":"Kirby CMS missing authorization in page draft rendering","severity":"medium","exploited":false,"published_at":"2026-07-16T22:17:01.967+00:00","url":"https://junglewise.ai/threats/cve-2026-44176-kirby-cms-missing-authorization-in-page-draft-rendering"},{"cve":"CVE-2026-44175","cvss":8.5,"slug":"cve-2026-44175-kirby-cms-persistent-xss-in-list-field","title":"Kirby CMS persistent XSS in list field","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:01.833+00:00","url":"https://junglewise.ai/threats/cve-2026-44175-kirby-cms-persistent-xss-in-list-field"},{"cve":"CVE-2026-44174","cvss":8.7,"slug":"cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries","title":"Kirby CMS arbitrary method call in REST API collection queries","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:01.65+00:00","url":"https://junglewise.ai/threats/cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries"},{"cve":"CVE-2026-54005","cvss":7.1,"slug":"cve-2026-54005-kirby-cms-missing-authorization-in-site-find-api-route","title":"Kirby CMS missing authorization in site/find API route","severity":"high","exploited":false,"published_at":"2026-07-09T19:17:06.4+00:00","url":"https://junglewise.ai/threats/cve-2026-54005-kirby-cms-missing-authorization-in-site-find-api-route"},{"cve":"CVE-2026-54004","cvss":6.3,"slug":"cve-2026-54004-kirby-cms-missing-authorization-for-draft-files-in-clean-file","title":"Kirby CMS missing authorization for draft files in clean file redirects","severity":"medium","exploited":false,"published_at":"2026-07-09T19:17:06.27+00:00","url":"https://junglewise.ai/threats/cve-2026-54004-kirby-cms-missing-authorization-for-draft-files-in-clean-file"},{"cve":"CVE-2026-50188","cvss":6.9,"slug":"cve-2026-50188-kirby-cms-crlf-injection-in-http-remote-class","title":"Kirby CMS CRLF injection in Http Remote class","severity":"medium","exploited":false,"published_at":"2026-07-09T19:17:05.827+00:00","url":"https://junglewise.ai/threats/cve-2026-50188-kirby-cms-crlf-injection-in-http-remote-class"},{"cve":"CVE-2026-49276","cvss":7.4,"slug":"cve-2026-49276-kirby-cms-self-xss-in-writer-field","title":"Kirby CMS self-XSS in writer field","severity":"high","exploited":false,"published_at":"2026-07-09T19:17:05.67+00:00","url":"https://junglewise.ai/threats/cve-2026-49276-kirby-cms-self-xss-in-writer-field"},{"cve":"CVE-2026-42174","cvss":4.3,"epss":0.0003,"slug":"cve-2026-42174-kirby-cms-missing-authorization-for-user-avatar-management","title":"Kirby CMS missing authorization for user avatar management","severity":"medium","exploited":false,"published_at":"2026-05-09T04:16:23.6+00:00","url":"https://junglewise.ai/threats/cve-2026-42174-kirby-cms-missing-authorization-for-user-avatar-management"},{"cve":"CVE-2026-42137","cvss":6.5,"epss":0.0003,"slug":"cve-2026-42137-kirby-cms-incorrect-authorization-in-panel-and-rest-api","title":"Kirby CMS incorrect authorization in Panel and REST API permissions","severity":"medium","exploited":false,"published_at":"2026-05-09T04:16:22.653+00:00","url":"https://junglewise.ai/threats/cve-2026-42137-kirby-cms-incorrect-authorization-in-panel-and-rest-api"},{"cve":"CVE-2026-42069","cvss":6.5,"epss":0.0003,"slug":"cve-2026-42069-kirby-cms-missing-authorization-for-site-and-user-information","title":"Kirby CMS missing authorization for site and user information","severity":"high","exploited":false,"published_at":"2026-05-09T04:16:22.297+00:00","url":"https://junglewise.ai/threats/cve-2026-42069-kirby-cms-missing-authorization-for-site-and-user-information"},{"cve":"CVE-2026-42051","cvss":4.3,"epss":0.0004,"slug":"cve-2026-42051-kirby-cms-information-disclosure-in-system-api-endpoint","title":"Kirby CMS information disclosure in system API endpoint","severity":"medium","exploited":false,"published_at":"2026-05-09T04:16:22.11+00:00","url":"https://junglewise.ai/threats/cve-2026-42051-kirby-cms-information-disclosure-in-system-api-endpoint"}],"weekly":[{"week":"2026-06-29","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-06","critical":0,"exploited":0,"vulnerabilities":4},{"week":"2026-07-13","critical":0,"exploited":0,"vulnerabilities":6},{"week":"2026-07-20","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-07-27","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-03","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-10","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":3},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0}],"related":[{"name":"Kirby","slug":"kirby","vulnerabilities":20,"url":"https://junglewise.ai/threats/technologies/kirby"}],"technology":{"hub":true,"name":"Kirby CMS","slug":"kirby-cms","vendor":{"name":"Kirby","slug":"kirby","url":"https://junglewise.ai/threats/vendors/kirby"},"aliases":[],"category":"cms","homepage":"https://getkirby.com/","repo_url":"https://github.com/getkirby/kirby","description":"Kirby CMS is a file-based content management system that does not require a database.","url":"https://junglewise.ai/threats/technologies/kirby-cms"},"most_severe":[{"cve":"CVE-2026-44177","cvss":8.8,"slug":"cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup","title":"Kirby CMS path traversal and PHP file inclusion in user lookup","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:02.103+00:00","url":"https://junglewise.ai/threats/cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup"},{"cve":"CVE-2026-44174","cvss":8.7,"slug":"cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries","title":"Kirby CMS arbitrary method call in REST API collection queries","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:01.65+00:00","url":"https://junglewise.ai/threats/cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries"},{"cve":"CVE-2026-44175","cvss":8.5,"slug":"cve-2026-44175-kirby-cms-persistent-xss-in-list-field","title":"Kirby CMS persistent XSS in list field","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:01.833+00:00","url":"https://junglewise.ai/threats/cve-2026-44175-kirby-cms-persistent-xss-in-list-field"},{"cve":"CVE-2026-45368","cvss":8.4,"slug":"cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags","title":"Kirby CMS stored XSS via dangerous URL schemes in KirbyTags","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:02.68+00:00","url":"https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags"},{"cve":"CVE-2026-75594","cvss":8.2,"epss":0.0076,"slug":"cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes","title":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms","severity":"high","exploited":false,"published_at":"2026-08-31T21:17:48.76+00:00","url":"https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes"},{"cve":"CVE-2026-49276","cvss":7.4,"slug":"cve-2026-49276-kirby-cms-self-xss-in-writer-field","title":"Kirby CMS self-XSS in writer field","severity":"high","exploited":false,"published_at":"2026-07-09T19:17:05.67+00:00","url":"https://junglewise.ai/threats/cve-2026-49276-kirby-cms-self-xss-in-writer-field"},{"cve":"CVE-2026-54005","cvss":7.1,"slug":"cve-2026-54005-kirby-cms-missing-authorization-in-site-find-api-route","title":"Kirby CMS missing authorization in site/find API route","severity":"high","exploited":false,"published_at":"2026-07-09T19:17:06.4+00:00","url":"https://junglewise.ai/threats/cve-2026-54005-kirby-cms-missing-authorization-in-site-find-api-route"},{"cve":"CVE-2026-42069","cvss":6.5,"epss":0.0003,"slug":"cve-2026-42069-kirby-cms-missing-authorization-for-site-and-user-information","title":"Kirby CMS missing authorization for site and user information","severity":"high","exploited":false,"published_at":"2026-05-09T04:16:22.297+00:00","url":"https://junglewise.ai/threats/cve-2026-42069-kirby-cms-missing-authorization-for-site-and-user-information"},{"cve":"CVE-2026-75592","cvss":6.9,"epss":0.0068,"slug":"cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory","title":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incom","severity":"medium","exploited":false,"published_at":"2026-08-31T21:17:48.613+00:00","url":"https://junglewise.ai/threats/cve-2026-75592-kirby-path-traversal-in-media-handling-via-sibling-directory"},{"cve":"CVE-2026-69127","cvss":6.9,"epss":0.0051,"slug":"cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages","title":"Kirby REST API information disclosure via error messages","severity":"medium","exploited":false,"published_at":"2026-09-01T16:37:47+00:00","url":"https://junglewise.ai/threats/cve-2026-69127-kirby-rest-api-information-disclosure-via-error-messages"}],"generated_at":"2026-09-26T09:11:00.170868+00:00"}