Kirby CMS CVE-2026-44174
HIGH
GHSA-86rh-h242-j8xp
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessAuthenticate to Panel with low-privilege account
-
DeliverySend API collection query naming internal method
-
ExploitReflectively invoke password()/loginPasswordless()/delete()
-
ExecutionDisclose hashes or escalate to another user
-
ImpactTake over account or mass-delete models
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A05:2025 - Injection
ASVS 5.0
V15 - Secure Coding and Architecture Reflection safety, class allowlisting
|
| Exploitation Conditions | Exploitation requires an authenticated Kirby Panel account (CVSS PR:L) - the attacker must be a valid, if low-privileged, Panel user, so this is only reachable on sites that grant Panel access to potentially untrusted people (multi-author, client, or membership deployments). The concrete trigger is supplying an internal model method name (e.g. password(), root(), loginPasswordless(), delete()) as an attribute in a collection query (filter/sort/findBy/pluck/group) or in the search/not/filter/sort parameters of the REST API endpoints for users, children, files, blueprints, languages, roles or translations. No user interaction and no special non-default configuration are needed beyond the Panel being enabled and reachable. Limiting factors: destructive delete() actions still require the authenticated user to hold the corresponding delete permission, whereas disclosure (password/root) and loginPasswordless escalation are exploitable regardless of that permission; single-admin sites with no untrusted Panel users face negligible practical risk. |
| Impact | Signals are consistent but point to a targeted rather than mass-exploitable issue. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H, 8.7) reflects network reach, low complexity, no user interaction and full confidentiality/integrity/availability impact on the vulnerable system - but critically requires PR:L, a valid authenticated Panel account. That authentication gate explains the low EPSS (0.07%, 22nd percentile) and its absence from CISA KEV: this is not a wormable unauthenticated RCE. The vendor itself frames risk conditionally - high impact only where potential attackers exist among the authenticated Panel user group (multi-author, client, or membership sites). No SSVC record and no POC are provided. Net: a genuine high-priority patch for Kirby deployments with semi-trusted Panel users, but lower urgency for single-admin/trusted-editor sites. The 'RCE' tag is somewhat aspirational - the demonstrated impact is arbitrary method call yielding disclosure, account takeover and deletion, not independently confirmed native code execution. |
| Exploit ScenarioDerived | An attacker holding a low-privilege Panel account (for example on a multi-author blog or membership site) sends a crafted API request to a users or children endpoint with a filter/sort query naming a sensitive model method such as password() to harvest another user's password hash, or loginPasswordless() to escalate into a higher-privileged account. With sufficient role permissions they could instead pass delete() to a collection query and remove many models at once. No POC is published, and low attack complexity with no required user interaction make exploitation straightforward once Panel access is obtained. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv2 – Jul 16, 2026
Privilege escalation and sensitive-data disclosure in Kirby CMS (versions before 4.9.1 and 5.4.1) let authenticated Panel users invoke arbitrary model methods through unvalidated collection-query parameters. By naming internal methods such as password(), root(), loginPasswordless() or delete() in filter/sort/findBy queries or the equivalent REST API search endpoints, a low-privilege Panel user can leak password hashes and server filesystem paths, take over other accounts, or mass-delete content. No public exploit identified at time of analysis and EPSS is low (0.07%), but the vendor rates real-world impact as high for any site exposing the Panel to untrusted users.
Earlier versions of this analysis (1)
Arbitrary method call in Kirby CMS (versions ≤ 4.9.0 and 5.0.0–5.4.0) lets attackers in the pool of authenticated Panel users invoke unintended PHP model methods by abusing REST API search and collection-query parameters such as filter, sort, not, group, pluck, and findBy. Because Kirby did not validate which model attributes a query could reference, an attacker can reach sensitive methods like password() to leak password hashes, root() to disclose absolute server filesystem paths, loginPasswordless() to escalate into another user's account, or delete() to mass-delete queried models. No CVSS score, EPSS probability, or CISA KEV listing is provided in the source data, and no public exploit is identified at time of analysis, though the vendor rates the real-world impact as high.
RemediationAI
Vendor-released patch: upgrade to Kirby 4.9.1 (https://github.com/getkirby/kirby/releases/tag/4.9.1) or Kirby 5.4.1 (https://github.com/getkirby/kirby/releases/tag/5.4.1), or any later release. These versions add a blocklist of sensitive model methods that may not be called during collection operations and restrict the affected REST API endpoints to only search and pagination queries. If immediate upgrade is impossible, reduce exposure by tightening who can obtain a Panel account and by lowering untrusted roles' permissions so delete() and similar actions are not authorized - this limits write/deletion impact but does NOT stop password()/root() disclosure or loginPasswordless() escalation, which do not depend on those permissions. Where feasible, restrict Panel and API network access to trusted networks/VPN as an interim control, accepting the availability trade-off for remote editors. There is no safe configuration workaround for the underlying arbitrary-method-call flaw short of the patch, so patching should be prioritized over mitigations.
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in composer
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
Kirby is a file-based PHP CMS whose data model consists of model objects (users, pages, files) held in collection objects. Collection methods like filter(), sort(), group(), pluck() and findBy() - and REST API endpoints exposing search/not/filter/sort queries over users, children, files, blueprints, languages, roles and translations - let callers query models by any 'attribute'. The root cause is CWE-470 (Unsafe Reflection: use of externally-controlled input to select a method): Kirby resolved a query attribute to a model method without validating it against an allowlist, so any accessible method name supplied by the client was reflectively called. This converts a benign data-query surface into an arbitrary-method-call primitive across the whole model layer. CPE identifies the affected component as pkg:composer/getkirby_cms (the getkirby/cms Composer package).
Know when the next one hits your stack
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N
Network-reachable Panel/API with low-complexity method injection, but a valid Panel account is required so PR:L; full C/I/A within the app, scope unchanged.
Primary rating from Vendor (https://github.com/getkirby/kirby).
CVSS VectorVendor: https://github.com/getkirby/kirby
Lifecycle Timeline
2DescriptionCVE.org
TL;DR
This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users.
This vulnerability is of high severity for affected sites and has a high real-world impact.
----
Introduction
Arbitrary method call is a type of arbitrary code execution. It is a vulnerability that allows attackers to run any commands or code of the attacker's choice on a target machine or in a target process.
Depending on the set of accessible methods, this can lead to disclosure of sensitive information or to unintended and malicious write actions.
Affected components
Kirby's data model is made up of model objects that are contained in collection objects. These collections can be queried with methods such as $collection->filter(), $collection->sort(), $collection->group(), $collection->pluck() and $collection->findBy(). Each of these methods allows to query the models contained in the collection by any accessible model attribute (field or method).
Kirby also provides endpoints in its REST API that allow to search through users or through children and files of the site or of a particular page. These endpoints allow the search, not, filter and sort queries as well as options to paginate the result. The same kind of queries can also be provided to API collections such as /<site|page|user>/blueprints, /<site|page>/children, /<model>/files, /languages, /roles, /translations, /users and /<user>/roles.
Impact
In affected releases, Kirby did not validate the model attributes that were used in the collection queries. This allowed attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password() (disclosing the password hash) or root() (disclosing the absolute filesystem path on the server) as well as methods that perform impactful actions such as loginPasswordless() (causing a privilege escalation to another user) or delete() (deleting all queried models in one go if the authenticated user has appropriate permissions).
Patches
The problem has been patched in Kirby 4.9.1 and Kirby 5.4.1. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, Kirby has added a blocklist of sensitive model methods that should not be called during collection operations and limited the query options for the affected endpoints to search and pagination.
Credits
Kirby thanks @mojamojam for responsibly reporting the identified issue.
Executive ViewAI
Kirby CMS versions before 4.9.1 and 5.4.1 allow authenticated Panel users with low privileges to invoke sensitive internal methods via unvalidated query parameters, enabling attackers to extract password hashes, hijack administrator accounts, and mass-delete content. Organizations running vulnerable versions with Panel access granted to untrusted users face immediate risk of credential compromise and operational disruption.
Apply vendor patch.
Threat Intelligence Overview
NVD
CVE.org
EPSS
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.
Information disclosure occurs when an application unintentionally exposes sensitive data that aids attackers in reconnaissance or directly compromises security.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB