getkirby vulnerabilities

CVEs per yearBy the year they were published

1. 20202
2. 20214
3. 20223
4. 20235
5. 20242
6. 20254
7. 202627

Newest CVEs

• CVE-2026-108924

  getkirby Kirby Dynamic Option Generation OptionsQuery.php resolve authorization

  getkirby · Kirby

  Medium5.3
• CVE-2026-75594

  Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

  getkirby · kirby

  High8.2
• CVE-2026-75592

  Kirby: Access to image files outside of the site root via path traversal in the media handling

  getkirby · kirby

  Medium6.9
• CVE-2026-71415

  Kirby: File upload permissions are not checked during processing of chunk data

  getkirby · kirby

  High7.1
• CVE-2026-69127

  Kirby: System path exposure from error messages in the REST API

  getkirby · kirby

  Medium6.9
• CVE-2026-45368

  Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend

  getkirby · kirby

  High8.4
• CVE-2026-45334

  Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions

  getkirby · kirby

  Medium5.3
• CVE-2026-44175

  Kirby: Cross-site scripting (XSS) from list field content in the site frontend

  getkirby · kirby

  High8.5
• CVE-2026-44176

  Kirby: `pages.access` permission is not checked during rendering of page drafts

  getkirby · kirby

  Medium6.0
• CVE-2026-44177

  Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup

  getkirby · kirby

  High8.8