getkirby/cms Security Advisories for 5.0.0-beta.4 (10)
-
[MEDIUM] Kirby CMS's system API endpoint leaks installed version and license data to authenticated users
PKSA-d1w9-s6x2-nh6p CVE-2026-42051 GHSA-x68m-c7jf-2572
Affected version: >=5.0.0,<=5.3.3|<=4.8.0
Reported by:
GitHub -
[MEDIUM] Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions
PKSA-p78d-845h-8y84 CVE-2026-42174 GHSA-39cp-6679-8xv2
Affected version: >=5.0.0,<=5.3.3|<=4.8.0
Reported by:
GitHub -
[HIGH] Kirby CMS's read access to site, user and role information is not gated by permissions
PKSA-wrgq-xy3s-q6nz CVE-2026-42069 GHSA-2h7v-4372-f6x2
Affected version: >=5.0.0,<=5.3.3|<=4.8.0
Reported by:
GitHub -
[HIGH] Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
PKSA-bpcj-ysn7-my14 CVE-2026-42137 GHSA-85x2-r8xv-ww8c
Affected version: >=5.0.0,<=5.3.3|<=4.8.0
Reported by:
GitHub -
[HIGH] Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
PKSA-m1sp-3j4c-yg88 CVE-2026-41325 GHSA-6gqr-mx34-wh8r
Affected version: >=5.0.0,<5.4.0|<4.9.0
Reported by:
GitHub -
[MEDIUM] Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter
PKSA-pyk9-2q1t-drry CVE-2026-40099 GHSA-w942-j9r6-hr6r
Affected version: >=5.0.0,<5.4.0|<4.9.0
Reported by:
GitHub -
[HIGH] Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
PKSA-w67s-1md9-r7dk CVE-2026-34587 GHSA-jcjw-58rv-c452
Affected version: >=5.0.0,<5.4.0|<4.9.0
Reported by:
GitHub -
[MEDIUM] Kirby has XML injection in its XML creator toolkit
PKSA-rr97-2byk-h46m CVE-2026-32870 GHSA-9wfj-c55w-j9qr
Affected version: >=5.0.0,<5.4.0|<4.9.0
Reported by:
GitHub -
[MEDIUM] Kirby is missing permission checks in the content changes API
PKSA-yfpp-rndk-cm9x CVE-2026-21896 GHSA-4j78-4xrm-cr2f
Affected version: >=5.0.0,<=5.2.1
Reported by:
GitHub -
[MEDIUM] Kirby CMS has cross-site scripting (XSS) in the changes dialog
PKSA-jms5-zv67-g12r CVE-2025-65012 GHSA-84hf-8gh5-575j
Affected version: >=5.0.0,<5.1.4
Reported by:
GitHub