Security
فارسی
All products

getkirby/cms

Composer · Package
51 reports
Vulnerability alerts
Follow
ReportProductEcosystemSeverityFix statusLast updated
Kirby: `pages.access` permission is not checked in the `site/find` REST API routeCVE-2026-54005 · GHSA-R3W8-2C5R-H9J9 getkirby/cms Composer High Fix reported
Kirby: `pages.access` permission is not checked in the pages picker for parent pagesCVE-2026-49274 · GHSA-23Q2-54QV-RQ5X getkirby/cms Composer Medium Fix reported
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontendCVE-2026-45368 · GHSA-QVJF-922G-PJ44 getkirby/cms Composer High Fix reported
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookupCVE-2026-44177 · GHSA-9HX7-C53C-V6X8 getkirby/cms Composer High Fix reported
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissionsCVE-2026-45334 · GHSA-39VQ-49QM-R2MC getkirby/cms Composer Medium Fix reported
Kirby CMS's `pages.access` permission is not checked during rendering of page draftsCVE-2026-44176 · GHSA-2XW4-V2WX-HQQ9 getkirby/cms Composer Medium Fix reported
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query EndpointsCVE-2026-44174 · GHSA-86RH-H242-J8XP getkirby/cms Composer High Fix reported
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` headerCVE-2026-54003 · GHSA-WHXW-24JC-CWMV getkirby/cms Composer Critical Fix reported
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`CVE-2026-54002 · GHSA-WR9H-4R83-F4V6 getkirby/cms Composer High Fix reported
Kirby: Self cross-site scripting (self-XSS) in the writer fieldCVE-2026-49276 · GHSA-RHJ6-R49H-5932 getkirby/cms Composer High Fix reported
Kirby: Access to files of top-level drafts is not protected by permissionsCVE-2026-54004 · GHSA-89CP-7P28-JFFG getkirby/cms Composer Medium Fix reported
Kirby: Request header injection in `Http\Remote`CVE-2026-50188 · GHSA-4V4H-M2QQ-PPGW getkirby/cms Composer Medium Fix reported
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontendCVE-2026-44175 · GHSA-5FHX-9Q32-Q257 getkirby/cms Composer High Fix reported
Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" typeCVE-2024-27087 · GHSA-63H4-W25C-3QV4 getkirby/cms Composer Medium Fix reported
Denial of service from unlimited password lengthsCVE-2023-38492 · GHSA-3V6J-V3QC-CXFF getkirby/cms Composer Medium Fix reported
XML External Entity (XXE) vulnerability in the XML data handlerCVE-2023-38490 · GHSA-Q386-W6FG-GMGP getkirby/cms Composer Medium Fix reported
Insufficient Session Expiration after a password changeCVE-2023-38489 · GHSA-5MVJ-RVP8-RF45 getkirby/cms Composer High Fix reported
Field injection in the KirbyData text storage handlerCVE-2023-38488 · GHSA-X5MR-P6V4-WP93 getkirby/cms Composer High Fix reported
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5CVE-2020-26255 · GHSA-G3H8-CG9X-47QW getkirby/cmsgetkirby/panel Composer Medium Fix reported
Kirby: Access to image files outside of the site root via path traversal in the media handlingCVE-2026-75592 · GHSA-6J4C-MGQR-QV76 getkirby/cms Composer Medium Fix reported