PatchSiren

PatchSiren cyber security CVE debrief

CVE-2026-50188 getkirby CVE debrief

The CVE-2026-50188 vulnerability affects Kirby, an open-source content management system. The issue arises from the use of the Kirby Http Remote class, specifically in methods like Remote::request(), Remote::get(), and Remote::post(), which send outgoing HTTP requests. When using untrusted data in the headers option, an attacker could inject newline characters in a header value, leading to the creation of a separate, unintended request header to the remote service. This vulnerability has been addressed in Kirby versions 4.9.4 and 5.4.4.

Vendor
getkirby
Product
kirby
CVSS
MEDIUM 6.9
CISA KEV
Not listed in stored evidence
Original CVE published
2026-07-09
Original CVE updated
2026-07-10
Advisory published
2026-07-09
Advisory updated
2026-07-10

Who should care

Users of Kirby, especially those who utilize the Http Remote class for sending HTTP requests with dynamic or untrusted data in the headers, should be aware of this vulnerability. Site administrators and developers who rely on Kirby for content management need to ensure their installations are updated to versions 4.9.4 or 5.4.4 to mitigate this risk.

Technical summary

The vulnerability in Kirby's Http Remote class allows for header injection attacks. When sending HTTP requests with untrusted data in the headers, an attacker can inject newline characters to create additional, unintended headers. This issue is due to insufficient validation or sanitization of header values. The affected methods include Remote::request(), Remote::get(), and Remote::post(). The vulnerability's CVSS score is 6.9, classified as MEDIUM severity.

Defensive priority

Medium priority should be given to updating Kirby installations to the patched versions. Users should review their usage of the Http Remote class and ensure that any dynamic data used in headers is properly validated and sanitized.

Recommended defensive actions

  • Update Kirby to version 4.9.4 or 5.4.4.
  • Review and validate all dynamic data used in headers when utilizing the Http Remote class.
  • Implement additional monitoring for unusual HTTP requests originating from affected Kirby installations.
  • Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up.
  • Review the supplied official advisory or CVE record to validate affected scope, severity, and vendor guidance.
  • Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
  • Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record was published on 2026-07-09T19:17:05.827Z and last modified on 2026-07-10T15:49:19.093Z. The NVD entry is currently Deferred. Evidence is limited to public CVE and NVD data. Defenders should verify affected Kirby installations and review usage of the Http Remote class.

Official resources

AI-assisted PatchSiren debrief based on the supplied source corpus. The CVE record was published on 2026-07-09T19:17:05.827Z and has not been modified since then. The NVD entry is currently Deferred.