CVE-2026-69127 | | | 2026-08-07 | Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error mes… |
CVE-2026-45368 | | | 2026-07-16 | Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the underlying URL methods for the KirbyTags and image blocks componen… |
CVE-2026-45334 | | | 2026-07-16 | Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, the content-locking feature returned lock information without checking… |
CVE-2026-44177 | | | 2026-07-16 | Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resul… |
CVE-2026-44176 | | | 2026-07-16 | Kirby is an open-source content management system. Versions prior to 4.9.1 and 5.4.1 do not check the `pages.access` permission during page draft rendering. P… |
CVE-2026-44175 | | | 2026-07-16 | Kirby is an open-source content management system. In versions prior to 4.9.1 and 5.4.1, Kirby did not securely sanitize the contents of the list field on save… |
CVE-2026-44174 | | | 2026-07-16 | Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queri… |
CVE-2026-54005 | | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites where a role has the pages.access permission disabled allowed authenti… |
CVE-2026-54004 | | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clea… |
CVE-2026-54003 | | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible… |
CVE-2026-54002 | | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins that use the writer or list fields or call Dom::sanitize()… |
CVE-2026-50188 | | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::reque… |
CVE-2026-49276 | | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the writer field in any blueprint allowed a scripting link to be… |
CVE-2026-49274 | | | 2026-07-09 | Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites using the pages field with roles that have the pages.access permission… |
CVE-2026-42174 | Medium | 4.3 | 2026-05-09 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user upda… |
CVE-2026-42137 | Medium | 6.5 | 2026-05-09 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, `pages.access/list` and `files.access/list` permissions are not consisten… |
CVE-2026-42069 | Medium | 6.5 | 2026-05-09 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permission… |
CVE-2026-42051 | Medium | 4.3 | 2026-05-09 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authe… |
CVE-2026-41325 | High | 8.8 | 2026-04-24 | Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in… |
CVE-2026-40099 | Medium | 6.5 | 2026-04-24 | Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in… |
CVE-2026-34587 | High | 8.1 | 2026-04-24 | Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user permissions control which user role is allowed to perform sp… |
CVE-2026-32870 | High | 7.5 | 2026-04-24 | Kirby is an open-source content management system. Kirby's `Xml::value()` method has special handling for `<![CDATA[ ]]>` blocks. If the input value is already… |
CVE-2026-29905 | Medium | 6.5 | 2026-03-26 | Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The… |
CVE-2026-21896 | Medium | 5.7 | 2026-01-08 | Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerabil… |
CVE-2025-65012 | Medium | 5.4 | 2025-11-18 | Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a mali… |
CVE-2025-31493 | Critical | 9.1 | 2025-05-13 | Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the `coll… |
CVE-2025-30207 | High | 7.5 | 2025-05-13 | Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby setups that use PHP's bu… |
CVE-2025-30159 | Critical | 9.1 | 2025-05-13 | Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby sites that use the `snip… |
CVE-2024-41964 | High | 8.1 | 2024-08-29 | Kirby is a CMS targeting designers and editors. Kirby allows to restrict the permissions of specific user roles. Users of that role can only perform permitted… |
CVE-2024-27087 | Medium | 4.6 | 2024-02-26 | Kirby is a content management system. The new link field introduced in Kirby 4 allows several different link types that each validate the entered link to the r… |
CVE-2024-26484 | Medium | 6.1 | 2024-02-22 | A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers to execute arbitrary web scripts or HT… |
CVE-2024-26483 | High | 8.8 | 2024-02-22 | An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file. |
CVE-2024-26482 | High | 7.1 | 2024-02-22 | An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. NOTE: the vendor disputes the significance of this report because… |
CVE-2024-26481 | Medium | 4.7 | 2024-02-22 | Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. |
CVE-2023-38492 | Medium | 5.3 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user acco… |
CVE-2023-38491 | Medium | 5.7 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might hav… |
CVE-2023-38490 | Medium | 6.8 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 only affects Kirby sites that use the… |
CVE-2023-38489 | High | 7.3 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites with user acco… |
CVE-2023-38488 | High | 7.1 | 2023-07-27 | Kirby is a content management system. A vulnerability in versions prior to 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, and 3.9.6 affects all Kirby sites that might hav… |
CVE-2017-20174 | Medium | 5.6 | 2023-01-19 | A vulnerability was found in bastianallgeier Kirby Webmentions Plugin and classified as problematic. Affected by this issue is some unknown functionality. The… |
CVE-2022-39315 | Medium | 6.5 | 2022-10-25 | Kirby is a Content Management System. Prior to versions 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, a user enumeration vulnerability affects all Kirby sites with use… |
CVE-2022-39314 | Low | 3.7 | 2022-10-24 | Kirby is a flat-file CMS. In versions prior to 3.5.8.2, 3.6.6.2, 3.7.5.1, and 3.8.1, Kirby is subject to user enumeration due to Improper Restriction of Excess… |
CVE-2022-36037 | Medium | 5.9 | 2022-08-29 | kirby is a content management system (CMS) that adapts to many different projects and helps you build your own ideal interface. Cross-site scripting (XSS) is a… |
CVE-2018-14520 | Medium | 5.4 | 2022-08-24 | An issue was discovered in Kirby 2.5.12. The application allows malicious HTTP requests to be sent in order to trick a user into adding web pages. |
CVE-2018-14519 | Medium | 4.3 | 2022-08-24 | An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force th… |
CVE-2022-35174 | Medium | 5.4 | 2022-08-18 | A stored cross-site scripting (XSS) vulnerability in Kirby's Starterkit v3.7.0.2 allows attackers to execute arbitrary web scripts or HTML via a crafted payloa… |
CVE-2021-41258 | High | 7.3 | 2021-11-16 | Kirby is an open source file structured CMS. In affected versions Kirby's blocks field stores structured data for each block. This data is then used in block s… |
CVE-2021-41252 | High | 7.3 | 2021-11-16 | Kirby is an open source file structured CMS ### Impact Kirby's writer field stores its formatted content as HTML code. Unlike with other field types, it is not… |
CVE-2021-32735 | High | 7.1 | 2021-07-02 | Kirby is a content management system. In Kirby CMS versions 3.5.5 and 3.5.6, the Panel's `ListItem` component (used in the pages and files section for example)… |
CVE-2021-29460 | High | 7.6 | 2021-04-27 | Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like `<script>` tags. The dire… |
CVE-2020-26255 | Medium | 6.8 | 2020-12-08 | Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upl… |
CVE-2020-26253 | Medium | 6.8 | 2020-12-08 | Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may b… |
CVE-2018-16624 | Medium | 5.4 | 2019-05-13 | panel/pages/home/edit in Kirby v2.5.12 allows XSS via the title of a new page. |
CVE-2018-16623 | Medium | 4.8 | 2019-05-13 | Kirby V2.5.12 is prone to a Persistent XSS attack via the Title of the "Site options" in the admin panel dashboard dropdown. |
CVE-2018-16630 | Medium | 4.8 | 2018-12-28 | Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file. |
CVE-2018-16627 | Medium | 6.1 | 2018-12-20 | panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature. |
CVE-2018-16628 | Medium | 5.4 | 2018-12-04 | panel/login in Kirby v2.5.12 allows XSS via a blog name. |
CVE-2017-16807 | Medium | 5.4 | 2017-11-13 | A cross-site Scripting (XSS) vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared… |