CVE-2026-69127
Received Received - Intake

Information Disclosure in Kirby CMS

Publication date: 2026-08-07

Last updated on: 2026-08-07

Assigner: GitHub, Inc.

Description
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-08-07
Last Modified
2026-08-07
Generated
2026-08-07
AI Q&A
2026-08-07
EPSS Evaluated
N/A
NVD
CVE-2026-69127
EUVD
EUVD-2026-54577

Affected Vendors & Products

Showing 6 associated CPEs
Vendor Product Version / Range
kirby kirby to 4.9.5 (exc)
kirby kirby From 5.0.0 (inc) to 5.5.1 (inc)
kirby kirby 5.5.2
getkirby kirby From 5.0.0 (inc) to 5.5.1 (inc)
getkirby kirby 4.9.4
getkirby kirby 5.5.2

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-497 The product does not properly prevent sensitive system-level information from being accessed by unauthorized actors who do not have the same level of access to the underlying system as the product does.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability in Kirby CMS allows unauthenticated API users to receive unsanitized PHP error messages that expose the full filesystem path of the Kirby installation. It affects versions before 4.9.5 and from 5.0.0 through 5.5.1 unless the REST API is disabled. The issue occurs because error messages are not properly sanitized, revealing sensitive system information.

Detection Guidance

Check Kirby CMS version with composer show kirby/kirby or by inspecting the version in the Kirby panel. Look for unsanitized PHP error messages in API responses by sending test requests to REST API endpoints and checking for exposed filesystem paths in error outputs.

Impact Analysis

An attacker could use the exposed filesystem paths to guess default configuration values like content.salt or craft targeted attacks. The vulnerability primarily impacts confidentiality by revealing system information without requiring authentication or user interaction.

Compliance Impact

This vulnerability exposes filesystem paths through API error messages, which could lead to unauthorized information disclosure. For GDPR, this may violate Article 32 requirements for data security and integrity. HIPAA could be impacted if the exposed paths reveal sensitive system configurations or patient data storage locations.

Mitigation Strategies

Upgrade Kirby CMS to version 4.9.5 or 5.5.2 or later. If upgrading is not immediately possible, disable the REST API by setting 'api' => false in your Kirby configuration. Avoid enabling debug mode in production environments to prevent exposing sensitive path information.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-69127. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart