Medium
CVE-2026-75592
Vulnerability archive
Understand vulnerabilities. Protect your applications.
Discover which vulnerabilities affect your technologies and how to fix them. Explore clear explanations, affected versions and practical recommendations - from CMS platforms and plugins to application libraries.
Vulnerability archive 51
Reset filters
Medium
CVE-2026-69127
Kirby: System path exposure from error messages in the REST API
High
CVE-2026-71415
Kirby: File upload permissions are not checked during processing of chunk data
High
CVE-2026-75594
Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
High
CVE-2026-54005
Kirby: `pages.access` permission is not checked in the `site/find` REST API route
Medium
CVE-2026-54004
Kirby: Access to files of top-level drafts is not protected by permissions
Critical
CVE-2026-54003
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
High
CVE-2026-54002
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Medium
CVE-2026-50188
Kirby: Request header injection in `Http\Remote`
High
CVE-2026-49276
Kirby: Self cross-site scripting (self-XSS) in the writer field
Medium
CVE-2026-49274
Kirby: `pages.access` permission is not checked in the pages picker for parent pages
High
CVE-2026-45368
Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
Medium
CVE-2026-45334
Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions
High
CVE-2026-44177
Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
Medium
CVE-2026-44176
Kirby CMS's `pages.access` permission is not checked during rendering of page drafts
High
CVE-2026-44175
Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
High
CVE-2026-44174
Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
Medium
CVE-2026-42051
Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
Medium
CVE-2026-42174
Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions
High
CVE-2026-42069
Kirby CMS's read access to site, user and role information is not gated by permissions
High
CVE-2026-42137
Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
High
CVE-2026-41325
Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
Medium
CVE-2026-40099
Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
High
CVE-2026-34587
Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
Know which vulnerabilities affect your application
With the DockRay integration and software inventory enabled, DockRay checks reported component versions against known vulnerabilities and notifies you about confirmed matches. Coverage depends on the supported technology and available advisory data.