# Getkirby vulnerabilities Source: https://junglewise.ai/threats/vendors/getkirby Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats Updated: 12 November 2026, 03:07 UTC. Rebuilt every hour. Data: https://junglewise.ai/threats/vendors/getkirby.json License: CC BY 4.0 with a link back Junglewise Threat Intelligence has tracked 19 vulnerabilities in Getkirby: 0 in the last 7 days and 3 in the last 90 days, 1 of them critical and 0 exploited in the wild. The most recent, CVE-2026-108924, was published on 12 October 2026. 1 vulnerability in the last four weeks, up from none in the four before. 1 technology has a page of its own. ## Counts - Last 7 days: 0 - Last 30 days: 0 - Last 90 days: 3 - All time: 19 (1 critical, 0 exploited in the wild) ## Latest Getkirby vulnerabilities - [CVE-2026-108924: Getkirby Kirby authorization bypass in Dynamic Option Generation](https://junglewise.ai/threats/cve-2026-108924-a-vulnerability-was-identified-in-getkirby-kirby-up-to-4-9-5-5-5) (medium, CVSS 4.3, published 12 Oct 2026) - [CVE-2026-75594: Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes) (high, CVSS 4, published 31 Aug 2026) - [CVE-2026-71415: Kirby authorization bypass in REST API file uploads](https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads) (high, CVSS 4, published 31 Aug 2026) - [CVE-2026-45368: Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-45334: Kirby CMS information disclosure in content-locking feature](https://junglewise.ai/threats/cve-2026-45334-kirby-cms-information-disclosure-in-content-locking-feature) (medium, CVSS 4, published 16 Jul 2026) - [CVE-2026-44177: Kirby CMS path traversal and PHP file inclusion in user lookup](https://junglewise.ai/threats/cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-44175: Kirby CMS persistent XSS in list field](https://junglewise.ai/threats/cve-2026-44175-kirby-cms-persistent-xss-in-list-field) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-44174: Kirby CMS arbitrary method call in REST API collection queries](https://junglewise.ai/threats/cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-54004: Kirby CMS missing authorization for draft files in clean file redirects](https://junglewise.ai/threats/cve-2026-54004-kirby-cms-missing-authorization-for-draft-files-in-clean-file) (medium, CVSS 4, published 9 Jul 2026) - [CVE-2026-54003: Kirby CMS authentication bypass in Panel installation via header spoofing](https://junglewise.ai/threats/cve-2026-54003-kirby-cms-authentication-bypass-in-panel-installation-via-header) (critical, CVSS 4, published 9 Jul 2026) - [CVE-2026-54002: Kirby CMS stored XSS in Dom sanitization component](https://junglewise.ai/threats/cve-2026-54002-kirby-cms-stored-xss-in-dom-sanitization-component) (high, CVSS 4, published 9 Jul 2026) - [CVE-2026-50188: Kirby CMS CRLF injection in Http Remote class](https://junglewise.ai/threats/cve-2026-50188-kirby-cms-crlf-injection-in-http-remote-class) (medium, CVSS 4, published 9 Jul 2026) - [CVE-2026-49276: Kirby CMS self-XSS in writer field](https://junglewise.ai/threats/cve-2026-49276-kirby-cms-self-xss-in-writer-field) (high, CVSS 4, published 9 Jul 2026) - [CVE-2026-49274: Kirby CMS missing authorization in PagePicker component](https://junglewise.ai/threats/cve-2026-49274-kirby-cms-missing-authorization-in-pagepicker-component) (medium, CVSS 4, published 9 Jul 2026) - [CVE-2026-41325: Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection](https://junglewise.ai/threats/cve-2026-41325-kirby-is-vulnerable-to-authorization-bypass-during-page-file-and) (high, CVSS 8.8, published 24 Apr 2026) - [CVE-2026-40099: Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter](https://junglewise.ai/threats/cve-2026-40099-kirby-s-page-creation-api-bypasses-the-changestatus-permission) (medium, CVSS 6.5, published 24 Apr 2026) - [CVE-2026-34587: Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering](https://junglewise.ai/threats/cve-2026-34587-kirby-has-server-side-template-injection-ssti-via-double-template) (high, CVSS 8.1, published 24 Apr 2026) - [CVE-2026-32870: Kirby has XML injection in its XML creator toolkit](https://junglewise.ai/threats/cve-2026-32870-kirby-has-xml-injection-in-its-xml-creator-toolkit) (high, CVSS 7.5, published 24 Apr 2026) - [CVE-2025-65012: Kirby CMS has cross-site scripting (XSS) in the changes dialog](https://junglewise.ai/threats/cve-2025-65012-kirby-cms-has-cross-site-scripting-xss-in-the-changes-dialog) (medium, CVSS 5.4, published 18 Nov 2025) ## Most severe Getkirby vulnerabilities - [CVE-2026-54003: Kirby CMS authentication bypass in Panel installation via header spoofing](https://junglewise.ai/threats/cve-2026-54003-kirby-cms-authentication-bypass-in-panel-installation-via-header) (critical, CVSS 4, published 9 Jul 2026) - [CVE-2026-41325: Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection](https://junglewise.ai/threats/cve-2026-41325-kirby-is-vulnerable-to-authorization-bypass-during-page-file-and) (high, CVSS 8.8, published 24 Apr 2026) - [CVE-2026-34587: Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering](https://junglewise.ai/threats/cve-2026-34587-kirby-has-server-side-template-injection-ssti-via-double-template) (high, CVSS 8.1, published 24 Apr 2026) - [CVE-2026-32870: Kirby has XML injection in its XML creator toolkit](https://junglewise.ai/threats/cve-2026-32870-kirby-has-xml-injection-in-its-xml-creator-toolkit) (high, CVSS 7.5, published 24 Apr 2026) - [CVE-2026-44177: Kirby CMS path traversal and PHP file inclusion in user lookup](https://junglewise.ai/threats/cve-2026-44177-kirby-cms-path-traversal-and-php-file-inclusion-in-user-lookup) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-75594: Kirby path traversal in media handler via encoded slashes](https://junglewise.ai/threats/cve-2026-75594-kirby-path-traversal-in-media-handler-via-encoded-slashes) (high, CVSS 4, published 31 Aug 2026) - [CVE-2026-54002: Kirby CMS stored XSS in Dom sanitization component](https://junglewise.ai/threats/cve-2026-54002-kirby-cms-stored-xss-in-dom-sanitization-component) (high, CVSS 4, published 9 Jul 2026) - [CVE-2026-45368: Kirby CMS stored XSS via dangerous URL schemes in KirbyTags](https://junglewise.ai/threats/cve-2026-45368-kirby-cms-stored-xss-via-dangerous-url-schemes-in-kirbytags) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-44174: Kirby CMS arbitrary method call in REST API collection queries](https://junglewise.ai/threats/cve-2026-44174-kirby-cms-arbitrary-method-call-in-rest-api-collection-queries) (high, CVSS 4, published 16 Jul 2026) - [CVE-2026-71415: Kirby authorization bypass in REST API file uploads](https://junglewise.ai/threats/cve-2026-71415-kirby-authorization-bypass-in-rest-api-file-uploads) (high, CVSS 4, published 31 Aug 2026) ## Vulnerabilities per week 1 vulnerability in the last four weeks, up from none in the four before. | Week of | Vulns | Critical | Exploited | | --- | --- | --- | --- | | 17 Aug 2026 | 0 | 0 | 0 | | 24 Aug 2026 | 0 | 0 | 0 | | 31 Aug 2026 | 2 | 0 | 0 | | 7 Sep 2026 | 0 | 0 | 0 | | 14 Sep 2026 | 0 | 0 | 0 | | 21 Sep 2026 | 0 | 0 | 0 | | 28 Sep 2026 | 0 | 0 | 0 | | 5 Oct 2026 | 0 | 0 | 0 | | 12 Oct 2026 | 1 | 0 | 0 | | 19 Oct 2026 | 0 | 0 | 0 | | 26 Oct 2026 | 0 | 0 | 0 | | 2 Nov 2026 | 0 | 0 | 0 | | 9 Nov 2026 | 0 | 0 | 0 | ## Getkirby technologies - [Getkirby Kirby](https://junglewise.ai/threats/technologies/getkirby-kirby-1): 6 vulnerabilities ## Sources NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories. Rebuilt every hour. Cite as: Junglewise Threat Intelligence, "Getkirby vulnerabilities", https://junglewise.ai/threats/vendors/getkirby, 12 November 2026.