HTTP Header Injection in Kirby CMS

Executive Summary

CVE-2026-50188 is a request header injection vulnerability in the Kirby CMS affecting versions prior to 4.9.4 and 5.4.4. It occurs when untrusted user-controlled data is passed into the headers option of HTTP requests made using the Kirby\Http\Remote class methods such as Remote::request(), Remote::get(), and Remote::post().

Attackers can exploit this vulnerability by injecting newline characters (\r\n) into header values, which allows them to inject additional unintended HTTP headers or override existing ones in outgoing requests. This can lead to unauthorized modifications of security-relevant headers like Authorization, Host, or Cookie.

The issue arises because the header values are not properly sanitized to remove carriage return and newline characters, enabling header injection attacks. This vulnerability is fixed in Kirby versions 4.9.4 and 5.4.4 by stripping these characters from header values before sending the requests.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to manipulate outgoing HTTP requests from your Kirby CMS site or plugins that use the vulnerable Remote class methods. Specifically, attackers can inject or override HTTP headers, potentially leading to unauthorized actions.

• Injection of additional headers could allow attackers to perform request smuggling or cache poisoning attacks on the remote service.
• Unauthorized modification of security-relevant headers such as Authorization, Host, or Cookie could lead to security breaches or data leakage.
• The vulnerability requires network access but no special privileges or user interaction, making it moderately severe.

However, the vulnerability does not affect default Kirby installations and is only relevant if your site or plugins dynamically construct HTTP headers from untrusted user input.

Useful 0 Not Useful 0

Detection Guidance

This vulnerability involves injection of newline characters into HTTP request headers sent by the Kirby CMS Remote class. Detection involves identifying outgoing HTTP requests with suspicious header values containing CRLF (carriage return and line feed) characters.

You can monitor outgoing HTTP requests from your Kirby installation or plugins that use the Remote class to see if any headers contain newline characters or unexpected header injections.

Suggested commands include using network traffic analysis tools such as tcpdump or Wireshark to capture HTTP requests and inspect headers for CRLF sequences.

• tcpdump -i <interface> -A -s 0 'tcp port 80 or tcp port 443' | grep -P '\r|\n'
• Use Wireshark to filter HTTP requests and examine header fields for suspicious line breaks or injected headers.

Additionally, review your Kirby site code or plugins for usage of Remote::request(), Remote::get(), or Remote::post() methods with untrusted data in headers.

Useful 0 Not Useful 0

Mitigation Strategies

The primary mitigation is to upgrade Kirby CMS to version 4.9.4 or 5.4.4 or later, where the vulnerability is fixed by stripping carriage return and newline characters from header values before sending HTTP requests.

If upgrading immediately is not possible, review and sanitize any user-controlled input used in HTTP headers to ensure it does not contain newline characters.

Avoid passing untrusted data directly into the headers option of Remote::request(), Remote::get(), or Remote::post() methods.

Apply patches or code changes that remove CRLF characters from header values, similar to the fixes described in the Kirby source code updates.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability allows attackers to inject unauthorized HTTP headers by exploiting newline characters in header values, potentially modifying security-relevant headers such as Authorization, Host, or Cookie.

Such unauthorized modifications could lead to request smuggling or cache poisoning, which may result in unauthorized access or data leakage.

While the CVE description does not explicitly mention compliance with standards like GDPR or HIPAA, the ability to manipulate security headers and potentially expose sensitive data could impact compliance with these regulations, which require protection of personal and sensitive information.

Therefore, if exploited, this vulnerability could undermine the confidentiality and integrity requirements mandated by common standards and regulations.

Useful 0 Not Useful 0