[MEDIUM] Kirby: Request header injection in `Http\Remote`

PKSA-k11s-611y-v46q CVE-2026-50188 GHSA-4v4h-m2qq-ppgw

Affected package: getkirby/cms

Affected version: >=5.0.0-alpha.1,<=5.4.3|<=4.9.3

Reported by:
GitHub