Kirby CMS Vulnerabilities: Pre-Auth RCE, Arbitrary Method Call, and XSS (CVE-2026-44177, etc.)

Vulnerability Overview 1. Pre-authentication path traversal and PHP file inclusion during user lookup - CVE ID: CVE-2026-44177 - Severity: high (CVSS score 8.8) - Advisory: GHSA-9h7-c53c-vbx8 2. Arbitrary Method Call via REST API search and collection query endpoints - CVE ID: CVE-2026-44174 - Severity: high (CVSS score 8.7) - Advisory: GHSA-86h-h242-8xp 3. Cross-site scripting (XSS) from list field content in the site frontend - CVE ID: CVE-2026-44175 - Severity: high (CVSS score 8.5) - Advisory: GHSA-5hw-9q32-q257 4. Cross-site scripting (XSS) from links in KirbyTags, image blocks and imported blocks HTML in the site frontend - CVE ID: CVE-2026-45368 - Severity: high (CVSS score 8.4) - Advisory: GHSA-qpf-927g-py44 5. pages.access permission is not checked during rendering of page drafts - CVE ID: CVE-2026-44176 - Severity: moderate (CVSS score 6.0) - Advisory: GHSA-2xw4-v2wx-hqp9 6. Content locks disclose IDs and emails of inaccessible users from users.access/list permissions - CVE ID: CVE-2026-45334 - Severity: moderate (CVSS score 5.3) - Advisory: GHSA-39vq-49gm-2mc Impact Scope Pre-authentication path traversal and PHP file inclusion during user lookup: Affects all sites using Kirby 5.3.0-5.4.0, regardless of configuration settings and authentication methods. Arbitrary Method Call via REST API search and collection query endpoints: Affects Kirby sites with authenticated panel user groups that may contain potential attackers. Cross-site scripting (XSS) from list field content in the site frontend: Affects Kirby sites using list fields or list blocks where content is written by users who may not be fully trusted. Cross-site scripting (XSS) from links in KirbyTags, image blocks and imported blocks HTML in the site frontend: Affects Kirby sites using links, KirbyTags, image blocks, and imported block HTML where content is written by users who may not be fully trusted. pages.access permission is not checked during rendering of page drafts: Affects Kirby sites where specific roles are denied access to pages ( permission is disabled). Content locks disclose IDs and emails of inaccessible users from users.access/list permissions: Affects Kirby sites where certain roles are not allowed to view other users' information. Remediation Pre-authentication path traversal and PHP file inclusion during user lookup: Upgrade to version 5.4.1. Arbitrary Method Call via REST API search and collection query endpoints: Upgrade to version 5.4.1. Cross-site scripting (XSS) from list field content in the site frontend: Upgrade to version 5.4.1. Cross-site scripting (XSS) from links in KirbyTags, image blocks and imported blocks HTML in the site frontend: Upgrade to version 5.4.1. pages.access permission is not checked during rendering of page drafts: Upgrade to version 5.4.1. Content locks disclose IDs and emails of inaccessible users from users.access/list permissions: Upgrade to version 5.4.1. POC Code or Exploit Code No specific POC code or exploit code is provided.

Goal Reached Thanks to every supporter — we hit 100%!

Kirby CMS Vulnerabilities: Pre-Auth RCE, Arbitrary Method Call, and XSS (CVE-2026-44177, etc.)

More from this source