CVE-2026-69127: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere in getkirby kirby
Kirby CMS versions prior to 4.9.5 and from 5.0.0 through 5.5.1 have a vulnerability in the REST API error handler that can expose unsanitized PHP error messages. These messages reveal the full filesystem path of the Kirby installation to unauthenticated API users if the REST API is enabled. This exposure of sensitive system information could aid attackers in further reconnaissance. The issue is fixed in versions 4.9.5 and 5.5.2.
AI Analysis
Technical Summary
The vulnerability (CVE-2026-69127) in Kirby CMS affects versions before 4.9.5 and from 5.0.0 up to but not including 5.5.2. The REST API error handler returns unsanitized PHP error messages that disclose the full filesystem path of the Kirby installation to unauthenticated users when the REST API is enabled (not disabled via 'api' => false). This is an exposure of sensitive system information classified under CWE-497. The flaw does not require authentication and has a CVSS 4.0 base score of 6.9 (medium severity).
Potential Impact
Unauthenticated attackers can obtain the full filesystem path of the Kirby installation via error messages from the REST API. This information disclosure can facilitate further attacks by revealing system structure details. There is no indication of direct code execution or privilege escalation from this vulnerability alone.
Mitigation Recommendations
Upgrade Kirby CMS to version 4.9.5 or later if using the 4.x branch, or to version 5.5.2 or later if using the 5.x branch. Alternatively, disable the REST API by setting the 'api' option to false to prevent exposure of error messages. Patch status is confirmed fixed in these versions.
CVE-2026-69127: CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere in getkirby kirby
Description
Kirby CMS versions prior to 4.9.5 and from 5.0.0 through 5.5.1 have a vulnerability in the REST API error handler that can expose unsanitized PHP error messages. These messages reveal the full filesystem path of the Kirby installation to unauthenticated API users if the REST API is enabled. This exposure of sensitive system information could aid attackers in further reconnaissance. The issue is fixed in versions 4.9.5 and 5.5.2.
CVSS v4.0
Score 6.9medium
Affected software
pkg:github/getkirby/kirbyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability (CVE-2026-69127) in Kirby CMS affects versions before 4.9.5 and from 5.0.0 up to but not including 5.5.2. The REST API error handler returns unsanitized PHP error messages that disclose the full filesystem path of the Kirby installation to unauthenticated users when the REST API is enabled (not disabled via 'api' => false). This is an exposure of sensitive system information classified under CWE-497. The flaw does not require authentication and has a CVSS 4.0 base score of 6.9 (medium severity).
Potential Impact
Unauthenticated attackers can obtain the full filesystem path of the Kirby installation via error messages from the REST API. This information disclosure can facilitate further attacks by revealing system structure details. There is no indication of direct code execution or privilege escalation from this vulnerability alone.
Mitigation Recommendations
Upgrade Kirby CMS to version 4.9.5 or later if using the 4.x branch, or to version 5.5.2 or later if using the 5.x branch. Alternatively, disable the REST API by setting the 'api' option to false to prevent exposure of error messages. Patch status is confirmed fixed in these versions.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- GitHub_M
- Date Reserved
- 2026-08-03T15:20:30.217Z
- Cvss Version
- 4.0
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a762a7bbf8831d539f90bec
Added to database: 08/07/2026, 18:56:59 UTC
Last enriched: 08/07/2026, 19:17:02 UTC
Last updated: 08/07/2026, 19:17:02 UTC
Views: 4
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.