Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-44177— Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup

Quick assessment

Affected
getkirby kirby
Exploitation
Public or AI PoC available; prioritize validation
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Kirby Kirby是Kirby个人开发者的一款服务器与网络设备产品。 Kirby 5.3.0版本至5.4.1之前版本存在安全漏洞，该漏洞源于未正确验证用户ID，导致路径遍历，可能允许攻击者触发任意PHP文件包含和探测服务器目录。

AI Predicted 8.1 Difficulty: Easy EPSS 1.77% · P77

Public Exploits 1

Nuclei · 1 CVE-2026-44177.yaml [template]

Affected Version Matrix 1

VendorProduct Version RangeStatus
getkirby kirby >= 5.3.0, < 5.4.1 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-44177

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup
Source: CVE Program / CVE List V5
Vulnerability Description
Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user objects lazily when first needed. Users were queried by their ID, which was then used to locate the corresponding account directory under site/accounts. This affected the authentication API (accessible to unauthenticated requests), the users API (accessible only to authenticated users), and any other place that uses $users->find() to look up an individual user by a request-provided email or ID. As a result, an attacker could trigger arbitrary PHP file inclusion of files named  index.php (for example, the main PHP files of plugins), the impact of which depends on the logic those files contain. It also allowed probing for the existence of arbitrary directories on the server, letting attackers fingerprint the server and site setup, including installed plugins and the content structure. This issue has been fixed in version 5.4.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
对路径名的限制不恰当(路径遍历)
Source: CVE Program / CVE List V5
Vulnerability Title
Kirby 路径遍历漏洞
Source: CNNVD (China National Vulnerability Database)
Vulnerability Description
Kirby Kirby是Kirby个人开发者的一款服务器与网络设备产品。 Kirby 5.3.0版本至5.4.1之前版本存在安全漏洞，该漏洞源于未正确验证用户ID，导致路径遍历，可能允许攻击者触发任意PHP文件包含和探测服务器目录。
Source: CNNVD (China National Vulnerability Database)
CVSS Information
N/A
Source: CNNVD (China National Vulnerability Database)
Vulnerability Type
N/A
Source: CNNVD (China National Vulnerability Database)

Affected Products

Vendor Product Affected Versions CPE Subscribe
getkirby kirby >= 5.3.0, < 5.4.1 -

II. Public POCs for CVE-2026-44177

# POC Description Source Link Shenlong Link
1 Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences (such as "../.."), which the application concatenates directly into a filesystem path when hydrating user objects. This can result in the resolution of paths outside the intended accounts directory and may lead to the inclusion of unintended files such as index.php, causing a denial of service by exhausting memory limits. The issue is addressed in version 5.4.1 by properly validating and sanitizing the user-supplied input to prevent directory traversal. https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2026/CVE-2026-44177.yaml POC Details
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-44177

请登录查看更多情报信息。

Vendor Advisories for CVE-2026-44177 (1)

Vendor Pages for CVE-2026-44177 (1)

Same Patch Batch · getkirby · 2026-07-16 · 6 CVEs total

CVE-2026-44175 Kirby: Cross-site scripting (XSS) from list field content in the site frontend
CVE-2026-44174 Kirby: Arbitrary Method Call via REST API search and collection query endpoints
CVE-2026-44176 Kirby: `pages.access` permission is not checked during rendering of page drafts
CVE-2026-45368 Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site fro
CVE-2026-45334 Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list

IV. Related Vulnerabilities

Same product: kirby
Same vendor: getkirby
Same weakness: CWE-22

V. Comments for CVE-2026-44177

No comments yet

Leave a comment