[HIGH] Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup

PKSA-82wy-dsmt-xgpc CVE-2026-44177 GHSA-9hx7-c53c-v6x8

Affected package: getkirby/cms

Affected version: >=5.3.0,<=5.4.0

Reported by:
GitHub