CVE-2026-69127

MEDIUM

Kirby: System path exposure from error messages in the REST API

Title source: cna
STIX 2.1

Description

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.

References (3)

Core 3
Core References
X_Refsource_Misc x_refsource_misc
https:github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0
https:github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0

Scores

CVSS v4 6.9
EPSS 0.0029
EPSS Percentile 21.4%
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

CISA SSVC

Vulnrichment
Exploitation none
Automatable yes
Technical Impact partial

Details

CWE
CWE-497
Status published
Products (2)
getkirby/kirby < 4.9.5
getkirby/kirby >= 5.0.0, < 5.5.2
Published Aug 07, 2026
Tracked Since Aug 08, 2026