CVE-2026-69127 getkirby CVE debrief

Who should care

Defenders managing Kirby installations, particularly those with publicly accessible REST APIs, should assess exposure and consider updates or workarounds. This includes verifying Kirby installation versions and configurations, reviewing API access controls, and prioritizing remediation to prevent potential information disclosure. Security teams and operators should work together to ensure that affected installations are identified and remediated.

Why it matters

CVE-2026-69127 is a vulnerability in Kirby's REST API error handler that can expose sensitive filesystem path information to unauthenticated users. Defenders managing Kirby installations should verify exposure, assess the need for updates or workarounds, and prioritize remediation to prevent potential information disclosure.

• Potential exposure of sensitive filesystem path information.
• Risk of information disclosure to unauthenticated users.
• Need for verification of Kirby installation versions and configurations.
• Potential impact on security posture if left unremediated.

Technical summary

The REST API error handler in Kirby versions prior to 4.9.5 and 5.0.0 through 5.5.1 can return unsanitized PHP error messages, potentially exposing the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. The issue is fixed in versions 4.9.5 and 5.5.2. Defenders managing Kirby installations should verify exposure and assess the need for updates or workarounds to prevent potential information disclosure.

Defensive priority

Defenders should prioritize verifying exposure of Kirby installations to unauthenticated API users and assess the need for updates or workarounds.

Recommended defensive actions

• Verify Kirby installation versions and configurations to determine exposure.
• Assess the need for updates to versions 4.9.5 or 5.5.2.
• Review API access controls and consider disabling the REST API if not required.
• Confirm whether affected Kirby installations exist in managed environments and assign an owner for follow-up.
• Plan vendor-supported updates or mitigations through normal change control where exposure is confirmed.
• Review compensating controls for exposed systems while remediation is scheduled and verified.
• Check relevant monitoring, detection, and logs for exposed assets that need extra review.

Evidence notes

The CVE record and NVD entry provide details on the vulnerability in Kirby's REST API error handler, which can return unsanitized PHP error messages exposing the full filesystem path of the Kirby installation.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.