Vulnerability-Lookup

CVE-2026-69127 (GCVE-0-2026-69127)

Vulnerability from cvelistv5 – Published: 2026-08-07 18:33 – Updated: 2026-08-11 22:11

Title

Kirby: System path exposure from error messages in the REST API

Summary

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.

Severity

6.9 (Medium)


                        
                          CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: yes Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-08-07 18:56 UTC

CWE

CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

Assigner

GitHub_M CNA under the mitre root

CNA scorecard C 72/100 over 7761 records in the last 180 days details

References

3 references

URL	Tags
https://github.com/getkirby/kirby/security/adviso…	x_refsource_CONFIRM
https://github.com/getkirby/kirby/commit/469c5a1a…	x_refsource_MISC
https://github.com/getkirby/kirby/commit/58f81998…	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
getkirby	kirby	Affected: < 4.9.5 Affected: >= 5.0.0, < 5.5.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-69127",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T18:56:17.664088Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-08-07T18:56:25.591Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kirby",
          "vendor": "getkirby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.9.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the \u0027api\u0027 =\u003e false option. This issue is fixed in versions 4.9.5 and 5.5.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "NONE",
            "attackVector": "NETWORK",
            "baseScore": 6.9,
            "baseSeverity": "MEDIUM",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "LOW",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-497",
              "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-11T22:11:56.971Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh"
        },
        {
          "name": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0"
        },
        {
          "name": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451"
        }
      ],
      "source": {
        "advisory": "GHSA-rf2p-vh74-7vvh",
        "discovery": "UNKNOWN"
      },
      "title": "Kirby: System path exposure from error messages in the REST API"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-69127",
    "datePublished": "2026-08-07T18:33:19.614Z",
    "dateReserved": "2026-08-03T15:20:30.217Z",
    "dateUpdated": "2026-08-11T22:11:56.971Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-69127",
      "date": "2026-10-23",
      "epss": "0.00699",
      "percentile": "0.52617"
    },
    "nvd": {
      "cve": {
        "affected": [
          {
            "affectedData": [
              {
                "product": "kirby",
                "vendor": "getkirby",
                "versions": [
                  {
                    "status": "affected",
                    "version": "\u003c 4.9.5"
                  },
                  {
                    "status": "affected",
                    "version": "\u003e= 5.0.0, \u003c 5.5.2"
                  }
                ]
              }
            ],
            "source": "security-advisories@github.com"
          }
        ],
        "cveTags": [],
        "descriptions": [
          {
            "lang": "en",
            "value": "Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the \u0027api\u0027 =\u003e false option. This issue is fixed in versions 4.9.5 and 5.5.2."
          },
          {
            "lang": "es",
            "value": "Kirby es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. Antes de la 4.9.5 y desde la 5.0.0 hasta la 5.5.1, el gestor de errores de la API REST puede devolver mensajes de error PHP sin sanear que exponen la ruta completa del sistema de archivos de la instalaci\u00f3n de Kirby a usuarios de la API no autenticados. Esta vulnerabilidad afecta a todos los sitios de Kirby que no han deshabilitado la API REST con la opci\u00f3n \u2019api\u2019 =\u003e false. Este problema est\u00e1 solucionado en las versiones 4.9.5 y 5.5.2."
          }
        ],
        "id": "CVE-2026-69127",
        "lastModified": "2026-10-23T20:10:00.160",
        "metrics": {
          "cvssMetricV40": [
            {
              "cvssData": {
                "Automatable": "NOT_DEFINED",
                "Recovery": "NOT_DEFINED",
                "Safety": "NOT_DEFINED",
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "availabilityRequirement": "NOT_DEFINED",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "confidentialityRequirement": "NOT_DEFINED",
                "exploitMaturity": "NOT_DEFINED",
                "integrityRequirement": "NOT_DEFINED",
                "modifiedAttackComplexity": "NOT_DEFINED",
                "modifiedAttackRequirements": "NOT_DEFINED",
                "modifiedAttackVector": "NOT_DEFINED",
                "modifiedPrivilegesRequired": "NOT_DEFINED",
                "modifiedSubAvailabilityImpact": "NOT_DEFINED",
                "modifiedSubConfidentialityImpact": "NOT_DEFINED",
                "modifiedSubIntegrityImpact": "NOT_DEFINED",
                "modifiedUserInteraction": "NOT_DEFINED",
                "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
                "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
                "modifiedVulnIntegrityImpact": "NOT_DEFINED",
                "privilegesRequired": "NONE",
                "providerUrgency": "NOT_DEFINED",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "valueDensity": "NOT_DEFINED",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE",
                "vulnerabilityResponseEffort": "NOT_DEFINED"
              },
              "source": "security-advisories@github.com",
              "type": "Secondary"
            }
          ],
          "ssvcV203": [
            {
              "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "ssvcData": {
                "id": "CVE-2026-69127",
                "options": [
                  {
                    "exploitation": "none"
                  },
                  {
                    "automatable": "yes"
                  },
                  {
                    "technicalImpact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-08-07T18:56:17.664088Z",
                "version": "2.0.3"
              }
            }
          ]
        },
        "published": "2026-08-07T19:18:53.107",
        "references": [
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451"
          },
          {
            "source": "security-advisories@github.com",
            "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh"
          }
        ],
        "sourceIdentifier": "security-advisories@github.com",
        "vulnStatus": "Deferred",
        "weaknesses": [
          {
            "description": [
              {
                "lang": "en",
                "value": "CWE-497"
              }
            ],
            "source": "security-advisories@github.com",
            "type": "Secondary"
          }
        ]
      }
    },
    "vulnrichment": {
      "containers": {
        "adp": [
          {
            "metrics": [
              {
                "other": {
                  "content": {
                    "id": "CVE-2026-69127",
                    "options": [
                      {
                        "Exploitation": "none"
                      },
                      {
                        "Automatable": "yes"
                      },
                      {
                        "Technical Impact": "partial"
                      }
                    ],
                    "role": "CISA Coordinator",
                    "timestamp": "2026-08-07T18:56:17.664088Z",
                    "version": "2.0.3"
                  },
                  "type": "ssvc"
                }
              }
            ],
            "providerMetadata": {
              "dateUpdated": "2026-08-07T18:56:21.993Z",
              "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
              "shortName": "CISA-ADP"
            },
            "title": "CISA ADP Vulnrichment"
          }
        ],
        "cna": {
          "affected": [
            {
              "product": "kirby",
              "vendor": "getkirby",
              "versions": [
                {
                  "status": "affected",
                  "version": "\u003c 4.9.5"
                },
                {
                  "status": "affected",
                  "version": "\u003e= 5.0.0, \u003c 5.5.2"
                }
              ]
            }
          ],
          "descriptions": [
            {
              "lang": "en",
              "value": "Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the \u0027api\u0027 =\u003e false option. This issue is fixed in versions 4.9.5 and 5.5.2."
            }
          ],
          "metrics": [
            {
              "cvssV4_0": {
                "attackComplexity": "LOW",
                "attackRequirements": "NONE",
                "attackVector": "NETWORK",
                "baseScore": 6.9,
                "baseSeverity": "MEDIUM",
                "privilegesRequired": "NONE",
                "subAvailabilityImpact": "NONE",
                "subConfidentialityImpact": "NONE",
                "subIntegrityImpact": "NONE",
                "userInteraction": "NONE",
                "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
                "version": "4.0",
                "vulnAvailabilityImpact": "NONE",
                "vulnConfidentialityImpact": "LOW",
                "vulnIntegrityImpact": "NONE"
              }
            }
          ],
          "problemTypes": [
            {
              "descriptions": [
                {
                  "cweId": "CWE-497",
                  "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere",
                  "lang": "en",
                  "type": "CWE"
                }
              ]
            }
          ],
          "providerMetadata": {
            "dateUpdated": "2026-08-11T22:11:56.971Z",
            "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
            "shortName": "GitHub_M"
          },
          "references": [
            {
              "name": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh",
              "tags": [
                "x_refsource_CONFIRM"
              ],
              "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh"
            },
            {
              "name": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0"
            },
            {
              "name": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451",
              "tags": [
                "x_refsource_MISC"
              ],
              "url": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451"
            }
          ],
          "source": {
            "advisory": "GHSA-rf2p-vh74-7vvh",
            "discovery": "UNKNOWN"
          },
          "title": "Kirby: System path exposure from error messages in the REST API"
        }
      },
      "cveMetadata": {
        "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "assignerShortName": "GitHub_M",
        "cveId": "CVE-2026-69127",
        "datePublished": "2026-08-07T18:33:19.614Z",
        "dateReserved": "2026-08-03T15:20:30.217Z",
        "dateUpdated": "2026-08-11T22:11:56.971Z",
        "state": "PUBLISHED"
      },
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-69127

Vulnerability from fkie_nvd - Published: 2026-08-07 19:18 - Updated: 2026-10-23 20:10

Severity

6.9 (Medium) - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0
	security-advisories@github.com	https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451
	security-advisories@github.com	https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kirby",
          "vendor": "getkirby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.9.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.5.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the \u0027api\u0027 =\u003e false option. This issue is fixed in versions 4.9.5 and 5.5.2."
    },
    {
      "lang": "es",
      "value": "Kirby es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. Antes de la 4.9.5 y desde la 5.0.0 hasta la 5.5.1, el gestor de errores de la API REST puede devolver mensajes de error PHP sin sanear que exponen la ruta completa del sistema de archivos de la instalaci\u00f3n de Kirby a usuarios de la API no autenticados. Esta vulnerabilidad afecta a todos los sitios de Kirby que no han deshabilitado la API REST con la opci\u00f3n \u2019api\u2019 =\u003e false. Este problema est\u00e1 solucionado en las versiones 4.9.5 y 5.5.2."
    }
  ],
  "id": "CVE-2026-69127",
  "lastModified": "2026-10-23T20:10:00.160",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "NONE",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 6.9,
          "baseSeverity": "MEDIUM",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "LOW",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-69127",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "yes"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-08-07T18:56:17.664088Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-07T19:18:53.107",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Deferred",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-497"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-RF2P-VH74-7VVH

Vulnerability from github – Published: 2026-09-01 16:37 – Updated: 2026-09-01 16:37

Summary

Kirby: System path exposure from error messages in the REST API

Details

TL;DR

This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option.

It was possible to trigger a PHP error in the API backend that would expose the full filesystem path of the Kirby installation on the server. This could be used to guess the default content.salt or prepare specialized attacks.

Introduction

An information exposure occurs when system data or debugging information leaves the program through an output stream or logging function that makes it accessible to unauthorized parties. Using other weaknesses, an attacker could cause errors to occur; the response to these errors can reveal detailed system information, along with other impacts. An attacker can use messages that reveal technologies, operating systems, and product versions to tune the attack against known vulnerabilities in these technologies. A product may use diagnostic methods that provide significant implementation details such as stack traces as part of its error handling mechanism.

Affected components

Kirby's REST API at /api returns JSON data for each request. If an error occurs during processing of the request, a special error handler converts this error to JSON data that API frontends can handle.

The returned data for errors depends on the debugging mode. If the debug option is enabled, the JSON data contains fields for the path and line of the affected file, the internal exception class and the API route that caused the error. This data is omitted from error responses in production (when the debug option is disabled).

Impact

Some internal errors may contain sensitive information in the error message itself. This is often the case with PHP errors.

In affected releases, the REST API error handler did not sanitize error messages for sensitive information.

This exposed system information like the full source path to external API users, including users without authentication. This could be used to guess the default content.salt or prepare specialized attacks.

Patches

The problem has been patched in Kirby 4.9.5 and Kirby 5.5.2. Please update to one of these or a later version to fix the vulnerability.

In all of the mentioned releases, Kirby has hardened the API error handler to only expose full error messages for exceptions in the Kirby\Exception namespace. All other errors are only exposed in debug mode (with disguised paths, keeping only the paths relative to the Kirby installation). Outside of debug mode, general exceptions and PHP errors are replaced with a generic error message.

Credits

Thanks to Peter Levashov (@petersevera) for responsibly reporting the identified issue.

Severity

6.9 (Medium)


                  
                    CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.9.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getkirby/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getkirby/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-69127"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-497"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-09-01T16:37:47Z",
    "nvd_published_at": "2026-08-07T19:18:53Z",
    "severity": "MODERATE"
  },
  "details": "### TL;DR\n\nThis vulnerability affects all Kirby sites that have not disabled the REST API with the `\u0027api\u0027 =\u003e false` option.\n\nIt was possible to trigger a PHP error in the API backend that would expose the full filesystem path of the Kirby installation on the server. This could be used to guess the default `content.salt` or prepare specialized attacks.\n\n----\n\n### Introduction\n\nAn information exposure occurs when system data or debugging information leaves the program through an output stream or logging function that makes it accessible to unauthorized parties. Using other weaknesses, an attacker could cause errors to occur; the response to these errors can reveal detailed system information, along with other impacts. An attacker can use messages that reveal technologies, operating systems, and product versions to tune the attack against known vulnerabilities in these technologies. A product may use diagnostic methods that provide significant implementation details such as stack traces as part of its error handling mechanism.\n\n### Affected components\n\nKirby\u0027s REST API at `/api` returns JSON data for each request. If an error occurs during processing of the request, a special error handler converts this error to JSON data that API frontends can handle.\n\nThe returned data for errors depends on the debugging mode. If the `debug` option is enabled, the JSON data contains fields for the path and line of the affected file, the internal exception class and the API route that caused the error. This data is omitted from error responses in production (when the `debug` option is disabled).\n\n### Impact\n\nSome internal errors may contain sensitive information in the error message itself. This is often the case with PHP errors.\n\nIn affected releases, the REST API error handler did not sanitize error messages for sensitive information.\n\nThis exposed system information like the full source path to external API users, including users without authentication. This could be used to guess the default `content.salt` or prepare specialized attacks.\n\n### Patches\n\nThe problem has been patched in [Kirby 4.9.5](https://github.com/getkirby/kirby/releases/tag/4.9.5) and [Kirby 5.5.2](https://github.com/getkirby/kirby/releases/tag/5.5.2). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn all of the mentioned releases, Kirby has hardened the API error handler to only expose full error messages for exceptions in the `Kirby\\Exception` namespace. All other errors are only exposed in debug mode (with disguised paths, keeping only the paths relative to the Kirby installation). Outside of debug mode, general exceptions and PHP errors are replaced with a generic error message.\n\n### Credits\n\nThanks to Peter Levashov (@petersevera) for responsibly reporting the identified issue.",
  "id": "GHSA-rf2p-vh74-7vvh",
  "modified": "2026-09-01T16:37:47Z",
  "published": "2026-09-01T16:37:47Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-69127"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getkirby/kirby"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Kirby: System path exposure from error messages in the REST API"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Vulnerability timeline

Sightings and recorded dates, grouped by day · UTC

Order JSON

Publication & reservation Sightings KEV catalogs Other timestamps

Loading timeline…

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.
Browse all ATT&CK techniques and the vulnerabilities related to each.

Related by attack behaviour

Vulnerabilities whose description is nearest to this one in the vector space of the CIRCL/vulnerability-attack-technique-biencoder model. This is a similarity search over the bi-encoder space (plain cosine), not a classification, and it has no measured accuracy.

Action not permitted

CVE-2026-69127 (GCVE-0-2026-69127)

FKIE_CVE-2026-69127

GHSA-RF2P-VH74-7VVH

TL;DR

Introduction

Affected components

Impact

Patches

Credits

Tags

Sightings

Nomenclature

Vulnerability timeline

Related by attack behaviour