EUVD-2026-25371
GHSA-6gqr-mx34-wh8r
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Primary rating from GitHub Advisory · only source for this CVE.
CVSS VectorGitHub Advisory
Lifecycle Timeline
7DescriptionGitHub Advisory
Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model in the model blueprints (such as in site/blueprints/pages/...) using the options feature. The permissions and options together control the authorization of user actions. Kirby provides the pages.create, files.create and users.create permissions (among others). These permissions can again be set in the user blueprint and/or in the blueprint of the target model via options. Prior to versions 4.9.0 and 5.4.0, Kirby allowed to override the options during the creation of pages, files and users by injecting custom dynamic blueprint configuration into the model data. The injected options could include 'create' => true, which then caused an override of the permissions and options configured by the site developer in the user and model blueprints. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. The patched versions have updated the normalization code that is used during the creation of pages, files and users to include a filter for the blueprint property. This prevents the injection of dynamic blueprint configuration into the creation request.
AnalysisAI
Authenticated users in Kirby CMS can bypass permission controls to create unauthorized pages, files, and users by injecting malicious blueprint configuration during model creation. Versions prior to 4.9.0 and 5.4.0 fail to sanitize the 'blueprint' property in creation requests, allowing attackers with low-privilege accounts to override developer-defined authorization policies by setting 'create' => true in dynamic options. Patches are available in Kirby 4.9.0 and 5.4.0, which implement filtering of blueprint properties during normalization.
Technical ContextAI
Kirby CMS uses a role-based permission system defined in user blueprints (site/blueprints/users/) and model blueprints (site/blueprints/pages/). Permissions like 'pages.create', 'files.create', and 'users.create' control which roles can create content models. These permissions can be further customized via the 'options' feature in target model blueprints. The vulnerability stems from CWE-863 (Incorrect Authorization) in the model creation normalization code. Prior to patching, Kirby did not sanitize user-supplied data during page/file/user creation requests, allowing injection of arbitrary blueprint configuration including permission-overriding 'options' directives. The affected code processes model data before authorization checks, enabling attackers to dynamically rewrite the authorization policy for their own requests. Affected products per CPE data: Kirby CMS 4.x versions before 4.9.0 and 5.x versions before 5.4.0.
RemediationAI
Upgrade immediately to Kirby CMS 4.9.0 (for 4.x installations) or Kirby 5.4.0 (for 5.x installations), available at https://github.com/getkirby/kirby/releases. The patched versions implement input filtering in the normalization code to prevent blueprint property injection during page, file, and user creation requests. For environments unable to patch immediately, implement compensating controls by restricting Panel access to only highly trusted users, auditing all user creation/modification events in logs, and reviewing existing users for unauthorized privilege escalation (look for users with create permissions they should not have based on role definitions). Note that restricting network access to the Kirby Panel (typically /panel endpoint) via firewall rules or IP allowlisting reduces attack surface but does not eliminate risk from insider threats or compromised trusted accounts. Review authentication logs for unusual content creation patterns post-patch to identify potential historical exploitation. No workaround fully mitigates the vulnerability without upgrading.
An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbit
An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS v4.1.0. Rated high severity (CVSS
Kirby is an open-source content management system. Rated medium severity (CVSS 6.3), this vulnerability is remotely expl
A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of Kirby CMS v4.1.0 allows attackers
panel/login in Kirby v2.5.12 allows Host header injection via the "forget password" feature. Rated medium severity (CVSS
Kirby is a content management system. Rated critical severity (CVSS 10.0), this vulnerability is remotely exploitable, n
Kirby is an open source CMS. Rated medium severity (CVSS 5.4), this vulnerability is remotely exploitable, low attack co
panel/login in Kirby v2.5.12 allows XSS via a blog name. Rated medium severity (CVSS 5.4), this vulnerability is remotel
Kirby is a CMS. Rated critical severity (CVSS 9.1), this vulnerability is remotely exploitable, low attack complexity. T
Kirby is a content management system. Rated high severity (CVSS 8.8), this vulnerability is remotely exploitable, low at
Kirby v2.5.12 allows XSS by using the "site files" Add option to upload an SVG file. Rated medium severity (CVSS 4.8), t
Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. Rated medium severi
Same weakness CWE-863 – Incorrect Authorization
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today