These pages are published after PatchSiren validates generated defensive summaries against stored public CVE and source evidence.
A high-severity vulnerability was found in Kirby, an open-source content management system. The vulnerability affects versions prior to 4.9.1 and 5.4.1. It is related to the handling of URLs in certain components, which could lead to script execution. This issue has significant implications for users of affected versions, as it could allow attackers to execute malicious scripts. Users should review their [truncated]
A vulnerability in Kirby, an open-source content management system, allowed low-privilege authenticated users to learn the email address and identifier of any user who currently had a model open for editing in the Panel. This issue has been fixed in versions 4.9.1 and 5.4.1. The vulnerability affects Kirby installations with low-privilege authenticated Panel users, who could exploit this issue to learn se [truncated]
The Kirby content management system, in versions 5.3.0 and above but prior to 5.4.1, did not correctly validate user IDs, leading to a path traversal vulnerability. This issue allowed attackers to trigger arbitrary PHP file inclusion and probe for the existence of arbitrary directories on the server. The vulnerability was introduced as a performance improvement to the Users collection, loading user object [truncated]
The CVE record was published on 2026-07-16T22:17:01.967Z and has not been modified since then. The NVD entry is currently 6.0 MEDIUM. Kirby CMS versions prior to 4.9.1 and 5.4.1 have a vulnerability where page drafts can be accessed by any authenticated user, even if they do not have access to the specific page model. This vulnerability affects the path resolver for the main CMS router.
The CVE record describes a cross-site scripting (XSS) vulnerability in Kirby, an open-source content management system. Versions prior to 4.9.1 and 5.4.1 did not securely sanitize the contents of the list field on save, leaving it vulnerable to XSS attacks. The list field stores its formatted content as HTML, and unlike other field types, its HTML special characters cannot be escaped without losing the fo [truncated]
The CVE record for CVE-2026-44174 was published on 2026-07-16T22:17:01.650Z and has not been modified since then. The NVD entry is currently 8.7 HIGH. Kirby CMS did not validate model attributes used in collection queries, allowing attackers to include arbitrary model methods. This could lead to disclosure of sensitive data or impactful actions. Users of Kirby CMS versions prior to 4.9.1 and 5.4.1 should [truncated]
CVE-2026-54005 is a high-severity vulnerability in Kirby CMS that allows authenticated users to retrieve page information without authorization. The issue was fixed in versions 4.9.4 and 5.4.4. This vulnerability affects users with public sites or sensitive information, who should prioritize patching to prevent unauthorized access to page information. The vulnerability class is related to improper authori [truncated]
CVE-2026-54004 is a vulnerability in the Kirby content management system that allows unauthenticated access to draft file contents. This issue arises when the content.fileRedirects feature is enabled, allowing clean file URL requests for files stored in top-level draft pages to be redirected to physical media URLs without proper access permission checks or preview tokens. This could lead to the disclosure [truncated]
A critical vulnerability exists in Kirby, an open-source content management system. Versions prior to 4.9.4 and from 5.4.4 are affected by a vulnerability that allows remote attackers to install the Panel and create the first admin user on publicly accessible servers behind a reverse proxy. The issue arises from incorrect trust in Forwarded, X-Client-IP, or X-Real-IP request headers for local-IP checks. T [truncated]
A stored cross-site scripting vulnerability exists in Kirby, an open-source content management system, in versions prior to 4.9.4 and 5.4.4. The vulnerability arises from improper sanitization of user input in the writer or list fields or when calling certain sanitize functions with untrusted input, allowing malicious markup to be injected as children of an unknown HTML or XML tag. This issue can lead to [truncated]
The CVE-2026-50188 vulnerability affects Kirby, an open-source content management system. The issue arises from the use of the Kirby Http Remote class, specifically in methods like Remote::request(), Remote::get(), and Remote::post(), which send outgoing HTTP requests. When using untrusted data in the headers option, an attacker could inject newline characters in a header value, leading to the creation of [truncated]
A high-severity vulnerability was discovered in the Kirby content management system, affecting versions prior to 4.9.4 and 5.4.4. The vulnerability allows a user to inject a scripting link into the writer field of certain blueprints, enabling self cross-site scripting (XSS) in the Panel. This issue has significant implications for administrators and users of the Kirby CMS, particularly those using the wri [truncated]
The CVE record for CVE-2026-49274 was published on 2026-07-09T19:17:05.490Z and remains unchanged. The NVD entry is currently Deferred. This Kirby CMS vulnerability allows authenticated users to check for the existence of arbitrary pages and retrieve their title field values due to a flaw in the pages field when roles have the pages.access permission disabled. Users of Kirby CMS versions prior to 4.9.4 an [truncated]
CVE-2026-42174 is a medium-severity authorization issue in Kirby CMS. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement, and deletion were not properly gated by user update permissions. The issue was publicly disclosed on 2026-05-09 and patched in the stated fixed releases.
CVE-2026-42137 is a high-severity authorization flaw in Kirby CMS where `pages.access/list` and `files.access/list` permissions were not consistently enforced in the Panel and REST API. In affected versions before 4.9.0 and 5.4.0, that can expose page and file listing data to users who should not have access.
CVE-2026-42069 is a Kirby CMS access-control issue that allowed read access to site, user, and role information without permission checks. The issue was published on 2026-05-09 and is rated HIGH (CVSS 7.1). According to the official sources, the fix is available in Kirby 4.9.0 and 5.4.0.
CVE-2026-42051 is an information-disclosure issue in Kirby CMS. According to the supplied advisory and NVD record, authenticated users could access system API data that reveals license details and the installed version in versions prior to 4.9.0 and 5.4.0. The issue is patched in those releases. The reported severity is medium, consistent with limited confidentiality impact and no direct integrity or avai [truncated]