{"schema_version":1,"title":"Getkirby vulnerabilities","summary":"Junglewise Threat Intelligence has tracked 19 vulnerabilities in Getkirby: 0 in the last 7 days and 3 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-108924, was published on 12 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 technology has a page of its own.","url":"https://junglewise.ai/threats/vendors/getkirby","json_url":"https://junglewise.ai/threats/vendors/getkirby.json","publisher":"Junglewise Threat Intelligence","license":"CC-BY-4.0","license_url":"https://creativecommons.org/licenses/by/4.0/","attribution":"Junglewise Threat Intelligence, https://junglewise.ai/threats/vendors/getkirby","sources":"NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories","kind":"vendor","thin":false,"counts":{"high":11,"all_time":19,"critical":1,"exploited":0,"last_7_days":0,"last_30_days":0,"last_90_days":3,"last_365_days":19},"latest":[{"cve":"CVE-2026-108924","cvss":4.3,"epss":0.0041,"slug":"cve-2026-108924-a-vulnerability-was-identified-in-getkirby-kirby-up-to-4-9-5-5-5","title":"Getkirby Kirby authorization bypass in Dynamic Option Generation","severity":"medium","exploited":false,"published_at":"2026-10-12T20:17:08.457+00:00","url":"https://junglewise.ai/threats/cve-2026-108924-a-vulnerability-was-identified-in-getkirby-kirby-up-to-4-9-5-5-5"},{"cve":"CVE-2026-75594","cvss":4,"epss":0.0076,"slug":"cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes","title":"Kirby path traversal in media handler via encoded slashes","severity":"high","exploited":false,"published_at":"2026-08-31T21:17:48.76+00:00","url":"https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes"},{"cve":"CVE-2026-71415","cvss":4,"epss":0.0043,"slug":"cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads","title":"Kirby authorization bypass in REST API file uploads","severity":"high","exploited":false,"published_at":"2026-08-31T21:17:48.057+00:00","url":"https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads"},{"cve":"CVE-2026-45368","cvss":4,"epss":0.0053,"slug":"cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags","title":"Kirby CMS stored XSS via dangerous URL schemes in KirbyTags","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:02.68+00:00","url":"https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags"},{"cve":"CVE-2026-45334","cvss":4,"epss":0.0036,"slug":"cve-2026-45334-kirby-cms-information-disclosure-in-content-locking-feature","title":"Kirby CMS information disclosure in content-locking feature","severity":"medium","exploited":false,"published_at":"2026-07-16T22:17:02.55+00:00","url":"https://junglewise.ai/threats/cve-2026-45334-kirby-cms-information-disclosure-in-content-locking-feature"},{"cve":"CVE-2026-44177","cvss":4,"epss":0.0177,"slug":"cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup","title":"Kirby CMS path traversal and PHP file inclusion in user lookup","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:02.103+00:00","url":"https://junglewise.ai/threats/cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup"},{"cve":"CVE-2026-44175","cvss":4,"epss":0.0043,"slug":"cve-2026-44175-kirby-cms-persistent-xss-in-list-field","title":"Kirby CMS persistent XSS in list field","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:01.833+00:00","url":"https://junglewise.ai/threats/cve-2026-44175-kirby-cms-persistent-xss-in-list-field"},{"cve":"CVE-2026-44174","cvss":4,"epss":0.0049,"slug":"cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries","title":"Kirby CMS arbitrary method call in REST API collection queries","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:01.65+00:00","url":"https://junglewise.ai/threats/cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries"},{"cve":"CVE-2026-54004","cvss":4,"epss":0.005,"slug":"cve-2026-54004-kirby-cms-missing-authorization-for-draft-files-in-clean-file","title":"Kirby CMS missing authorization for draft files in clean file redirects","severity":"medium","exploited":false,"published_at":"2026-07-09T19:17:06.27+00:00","url":"https://junglewise.ai/threats/cve-2026-54004-kirby-cms-missing-authorization-for-draft-files-in-clean-file"},{"cve":"CVE-2026-54003","cvss":4,"epss":0.0074,"slug":"cve-2026-54003-kirby-cms-authentication-bypass-in-panel-installation-via-header","title":"Kirby CMS authentication bypass in Panel installation via header spoofing","severity":"critical","exploited":false,"published_at":"2026-07-09T19:17:06.12+00:00","url":"https://junglewise.ai/threats/cve-2026-54003-kirby-cms-authentication-bypass-in-panel-installation-via-header"},{"cve":"CVE-2026-54002","cvss":4,"epss":0.0055,"slug":"cve-2026-54002-kirby-cms-stored-xss-in-dom-sanitization-component","title":"Kirby CMS stored XSS in Dom sanitization component","severity":"high","exploited":false,"published_at":"2026-07-09T19:17:05.977+00:00","url":"https://junglewise.ai/threats/cve-2026-54002-kirby-cms-stored-xss-in-dom-sanitization-component"},{"cve":"CVE-2026-50188","cvss":4,"epss":0.0044,"slug":"cve-2026-50188-kirby-cms-crlf-injection-in-http-remote-class","title":"Kirby CMS CRLF injection in Http Remote class","severity":"medium","exploited":false,"published_at":"2026-07-09T19:17:05.827+00:00","url":"https://junglewise.ai/threats/cve-2026-50188-kirby-cms-crlf-injection-in-http-remote-class"},{"cve":"CVE-2026-49276","cvss":4,"epss":0.0043,"slug":"cve-2026-49276-kirby-cms-self-xss-in-writer-field","title":"Kirby CMS self-XSS in writer field","severity":"high","exploited":false,"published_at":"2026-07-09T19:17:05.67+00:00","url":"https://junglewise.ai/threats/cve-2026-49276-kirby-cms-self-xss-in-writer-field"},{"cve":"CVE-2026-49274","cvss":4,"epss":0.0048,"slug":"cve-2026-49274-kirby-cms-missing-authorization-in-pagepicker-component","title":"Kirby CMS missing authorization in PagePicker component","severity":"medium","exploited":false,"published_at":"2026-07-09T19:17:05.49+00:00","url":"https://junglewise.ai/threats/cve-2026-49274-kirby-cms-missing-authorization-in-pagepicker-component"},{"cve":"CVE-2026-41325","cvss":8.8,"epss":0.0036,"slug":"cve-2026-41325-kirby-is-vulnerable-to-authorization-bypass-during-page-file-and","title":"Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection","severity":"high","exploited":false,"published_at":"2026-04-24T01:16:12.427+00:00","url":"https://junglewise.ai/threats/cve-2026-41325-kirby-is-vulnerable-to-authorization-bypass-during-page-file-and"},{"cve":"CVE-2026-40099","cvss":6.5,"epss":0.0028,"slug":"cve-2026-40099-kirby-s-page-creation-api-bypasses-the-changestatus-permission","title":"Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter","severity":"medium","exploited":false,"published_at":"2026-04-24T01:16:12.273+00:00","url":"https://junglewise.ai/threats/cve-2026-40099-kirby-s-page-creation-api-bypasses-the-changestatus-permission"},{"cve":"CVE-2026-34587","cvss":8.1,"epss":0.0033,"slug":"cve-2026-34587-kirby-has-server-side-template-injection-ssti-via-double-template","title":"Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering","severity":"high","exploited":false,"published_at":"2026-04-24T01:16:12.12+00:00","url":"https://junglewise.ai/threats/cve-2026-34587-kirby-has-server-side-template-injection-ssti-via-double-template"},{"cve":"CVE-2026-32870","cvss":7.5,"epss":0.0035,"slug":"cve-2026-32870-kirby-has-xml-injection-in-its-xml-creator-toolkit","title":"Kirby has XML injection in its XML creator toolkit","severity":"high","exploited":false,"published_at":"2026-04-24T01:16:11.953+00:00","url":"https://junglewise.ai/threats/cve-2026-32870-kirby-has-xml-injection-in-its-xml-creator-toolkit"},{"cve":"CVE-2025-65012","cvss":5.4,"epss":0.0018,"slug":"cve-2025-65012-kirby-cms-has-cross-site-scripting-xss-in-the-changes-dialog","title":"Kirby CMS has cross-site scripting (XSS) in the changes dialog","severity":"medium","exploited":false,"published_at":"2025-11-18T23:15:55.913+00:00","url":"https://junglewise.ai/threats/cve-2025-65012-kirby-cms-has-cross-site-scripting-xss-in-the-changes-dialog"}],"vendor":{"hub":true,"name":"Getkirby","slug":"getkirby","url":"https://junglewise.ai/threats/vendors/getkirby"},"weekly":[{"week":"2026-08-17","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-24","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-08-31","critical":0,"exploited":0,"vulnerabilities":2},{"week":"2026-09-07","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-14","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-21","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-09-28","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-05","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-12","critical":0,"exploited":0,"vulnerabilities":1},{"week":"2026-10-19","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-10-26","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-02","critical":0,"exploited":0,"vulnerabilities":0},{"week":"2026-11-09","critical":0,"exploited":0,"vulnerabilities":0}],"most_severe":[{"cve":"CVE-2026-54003","cvss":4,"epss":0.0074,"slug":"cve-2026-54003-kirby-cms-authentication-bypass-in-panel-installation-via-header","title":"Kirby CMS authentication bypass in Panel installation via header spoofing","severity":"critical","exploited":false,"published_at":"2026-07-09T19:17:06.12+00:00","url":"https://junglewise.ai/threats/cve-2026-54003-kirby-cms-authentication-bypass-in-panel-installation-via-header"},{"cve":"CVE-2026-41325","cvss":8.8,"epss":0.0036,"slug":"cve-2026-41325-kirby-is-vulnerable-to-authorization-bypass-during-page-file-and","title":"Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection","severity":"high","exploited":false,"published_at":"2026-04-24T01:16:12.427+00:00","url":"https://junglewise.ai/threats/cve-2026-41325-kirby-is-vulnerable-to-authorization-bypass-during-page-file-and"},{"cve":"CVE-2026-34587","cvss":8.1,"epss":0.0033,"slug":"cve-2026-34587-kirby-has-server-side-template-injection-ssti-via-double-template","title":"Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering","severity":"high","exploited":false,"published_at":"2026-04-24T01:16:12.12+00:00","url":"https://junglewise.ai/threats/cve-2026-34587-kirby-has-server-side-template-injection-ssti-via-double-template"},{"cve":"CVE-2026-32870","cvss":7.5,"epss":0.0035,"slug":"cve-2026-32870-kirby-has-xml-injection-in-its-xml-creator-toolkit","title":"Kirby has XML injection in its XML creator toolkit","severity":"high","exploited":false,"published_at":"2026-04-24T01:16:11.953+00:00","url":"https://junglewise.ai/threats/cve-2026-32870-kirby-has-xml-injection-in-its-xml-creator-toolkit"},{"cve":"CVE-2026-44177","cvss":4,"epss":0.0177,"slug":"cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup","title":"Kirby CMS path traversal and PHP file inclusion in user lookup","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:02.103+00:00","url":"https://junglewise.ai/threats/cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup"},{"cve":"CVE-2026-75594","cvss":4,"epss":0.0076,"slug":"cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes","title":"Kirby path traversal in media handler via encoded slashes","severity":"high","exploited":false,"published_at":"2026-08-31T21:17:48.76+00:00","url":"https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes"},{"cve":"CVE-2026-54002","cvss":4,"epss":0.0055,"slug":"cve-2026-54002-kirby-cms-stored-xss-in-dom-sanitization-component","title":"Kirby CMS stored XSS in Dom sanitization component","severity":"high","exploited":false,"published_at":"2026-07-09T19:17:05.977+00:00","url":"https://junglewise.ai/threats/cve-2026-54002-kirby-cms-stored-xss-in-dom-sanitization-component"},{"cve":"CVE-2026-45368","cvss":4,"epss":0.0053,"slug":"cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags","title":"Kirby CMS stored XSS via dangerous URL schemes in KirbyTags","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:02.68+00:00","url":"https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags"},{"cve":"CVE-2026-44174","cvss":4,"epss":0.0049,"slug":"cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries","title":"Kirby CMS arbitrary method call in REST API collection queries","severity":"high","exploited":false,"published_at":"2026-07-16T22:17:01.65+00:00","url":"https://junglewise.ai/threats/cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries"},{"cve":"CVE-2026-71415","cvss":4,"epss":0.0043,"slug":"cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads","title":"Kirby authorization bypass in REST API file uploads","severity":"high","exploited":false,"published_at":"2026-08-31T21:17:48.057+00:00","url":"https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads"}],"generated_at":"2026-11-12T03:07:00.164048+00:00","technologies":[{"name":"Getkirby Kirby","slug":"getkirby-kirby-1","vulnerabilities":6,"url":"https://junglewise.ai/threats/technologies/getkirby-kirby-1"}]}