Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, read access to site, user and role information is not gated by permissions. This issue has been patched in versions 4.9.0 and 5.4.0.
CVE-2026-41325 is a high-severity vulnerability in the Kirby CMS prior to versions 4.9.0 and 5.4.0. It involves incorrect authorization due to the ability to override user permissions during the creation of pages, files, and users by injecting custom dynamic blueprint configurations. This flaw allowed attackers with limited privileges to bypass intended permission restrictions by injecting an 'options' property with 'create' set to true. The issue has been fixed in Kirby versions 4.9.0 and 5.
Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions. For pages, Kirby provides the `pages.create` and `pages.changeStatus` permissions (among others). Prior to versions 4.9.0 and 5.4.0, Kirby checked these permissions independently and only for the respective action. However the `changeStatus` permission didn't take effect on page creation. New pages are created as drafts by default and need to be published by changing the page status of an existing page draft. This is ensured when the page is created via the Kirby Panel. However the REST API allows to override the `isDraft` flag when creating a new page. This allowed authenticated attackers with the `pages.create` permission to immediately create published pages, bypassing the normal editorial workflow. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. Kirby has added a check to the page creation rules that ensures that users without the `pages.changeStatus` permission cannot create published pages, only page drafts.
CVE-2026-34587 is a high-severity vulnerability in the Kirby CMS prior to versions 4.9.0 and 5.4.0. It involves improper neutralization of special elements in the template engine related to user permissions. Specifically, authenticated users with the pages.create permission could bypass the intended editorial workflow by creating published pages directly via the REST API, overriding the isDraft flag. This bypass occurs because the changeStatus permission was not enforced on page creation through the API. The issue has been fixed in Kirby versions 4.
CVE-2026-32870 is an XML Injection vulnerability in the getkirby CMS affecting versions prior to 4.9.0 and between 5.0.0 and before 5.4.0. The issue arises from improper handling of CDATA blocks in the Xml::value() method, allowing structured data outside valid CDATA blocks to bypass escaping protections. This vulnerability can be exploited if site or plugin code uses the vulnerable XML generation methods to create XML strings from input data, potentially enabling manipulation of systems that process these XML files. The vulnerability does not affect Kirby core functionality or sites that do not use XML generation in site or plugin code.
Kirby is an open-source content management system. From versions 5.0.0 to 5.2.1, Kirby is missing permission checks in the content changes API. This vulnerability affects all Kirby sites where user permissions are configured to prevent specific role(s) from performing write actions, specifically by disabling the update permission with the intent to prevent modifications to site content. This vulnerability does not affect those who have not altered the deviated from default user permissions. This issue has been patched in version 5.2.2.
Kirby is an open-source content management system. From versions 5.0.0 to 5.1.3, attackers could change the title of any page or the name of any user to a malicious string. Then they could modify any content field of the same model without saving, making the model a candidate for display in the "Changes" dialog. If another authenticated user subsequently opened the dialog in their Panel, the malicious code would be executed. This vulnerability affects all Kirby 5 sites that might have potential attackers in the group of authenticated Panel users or that allow external visitors to update page titles or usernames. The attack requires user interaction by another Panel user and cannot be automated. This issue has been patched in version 5.1.4.