Kirby CMS EUVD-2026-54577

Exploitation requires that the Kirby REST API is active, which is the default configuration - sites that have explicitly added 'api' => false to their Kirby config are not affected. No authentication, elevated privileges, or user interaction is required; the CVSS 4.0 vector PR:N/UI:N confirms unauthenticated remote exploitation against default-configured Kirby installations. The disclosed information is limited to filesystem paths embedded in PHP exception messages; exploitation does not enable code execution, data modification, or denial of service. Both the 4.x and 5.x release tracks are vulnerable, with different fix versions for each branch.

The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N) confirms unauthenticated, network-accessible exploitation with no attack complexity or user interaction required, reflecting the default-enabled state of the Kirby REST API. Impact is limited to low confidentiality disclosure (VC:L) - there is no integrity or availability impact. The 6.9 CVSS 4.0 score is proportionate: this is a genuine information-disclosure risk that reduces attacker reconnaissance effort and enables path-dependent follow-on attacks (LFI, targeted config harvesting), but is not directly exploitable for code execution or data manipulation. No EPSS score was provided in the intelligence data; no CISA KEV listing exists, and no public exploit has been identified - suggesting opportunistic exploitation is not yet occurring. The risk is highest for sites with predictable directory structures or collocated sensitive configuration files.

An unauthenticated attacker sends an HTTP request to a Kirby REST API route that triggers a native PHP exception - for example, by providing input that causes a file operation to fail. The error handler returns a JSON response containing the raw exception message, which includes the server's absolute filesystem path (e.g., 'Could not open /var/www/sites/kirby-prod/content/pages/home/home.txt'). The attacker records this path to target subsequent attacks, such as path traversal attempts or locating known Kirby configuration file locations.