SB2026072035 - Multiple vulnerabilities in Kirby

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072035

SB2026072035 - Multiple vulnerabilities in Kirby

Published: July 20, 2026

Security Bulletin ID SB2026072035
CSH Severity
High
Patch available
YES
Number of vulnerabilities 7
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 14% Low 86%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 7 vulnerabilities.


1) External Initialization of Trusted Variables or Data Stores (CVE-ID: CVE-2026-54003)

CWE-ID: CWE-454 - External Initialization of Trusted Variables or Data Stores

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:U/U:Amber


The vulnerability allows a remote attacker to create an administrative account.

The vulnerability exists due to external initialization of trusted variables or data stores in the Panel installation logic and REST API authentication flow when handling installation requests behind a reverse proxy that sets the Forwarded, X-Client-IP, or X-Real-IP header. A remote attacker can send a crafted installation request to create an administrative account.

Only installations with no configured user accounts on publicly accessible servers behind affected reverse proxy setups are vulnerable.


2) Cross-site scripting (CVE-ID: CVE-2026-54002)

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:P/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary JavaScript in the browser context of other users.

The vulnerability exists due to cross-site scripting in Dom::sanitize() when sanitizing untrusted HTML/XML content. A remote user can store malicious markup that survives sanitization to execute arbitrary JavaScript in the browser context of other users.

The issue is a stored XSS condition that can affect Panel sessions and frontend views, and user interaction is limited to a victim viewing the rendered content or served file.


3) Missing Authorization (CVE-ID: CVE-2026-54005)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to missing authorization in the /api/site/find REST API route when handling requests for page IDs or UUIDs. A remote user can request arbitrary pages to disclose sensitive information.

Exploitation requires authentication and knowledge or guessing of page IDs or UUIDs. Only published pages are exposed, and write actions are not affected.


4) HTTP response splitting (CVE-ID: CVE-2026-50188)

CWE-ID: CWE-113 - Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Response Splitting')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to inject or override HTTP headers in outgoing requests.

The vulnerability exists due to improper neutralization of CRLF sequences in Kirby\Http\Remote when processing user-controlled header values. A remote attacker can supply header values containing newline characters to inject or override HTTP headers in outgoing requests.

The issue is only exposed when custom code or plugins pass untrusted input into the headers option, and it targets the remote service that receives the outgoing request.


5) Missing Authorization (CVE-ID: CVE-2026-54004)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to missing authorization in clean file redirects for top-level draft files when handling requests for clean file URLs. A remote attacker can request a known clean file URL to disclose sensitive information.

Only files stored in top-level drafts are affected, and exploitation requires knowledge of the full clean file URL.


6) Improper Neutralization of Script in Attributes in a Web Page (CVE-ID: CVE-2026-49276)

CWE-ID: CWE-83 - Improper Neutralization of Script in Attributes in a Web Page

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to execute arbitrary script code in the user's browser.

The vulnerability exists due to improper neutralization of script in attributes in a web page in the writer field link and email marks when handling user-supplied link targets. A remote user can inject a crafted javascript: link and cause script execution in the user's browser.

Successful exploitation commonly requires knowledge of the content structure and social engineering, and user interaction is required to click the crafted link before the content is saved. In the default configuration, the issue is limited to self-XSS within the Panel.


7) Missing Authorization (CVE-ID: CVE-2026-49274)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to disclose sensitive information.

The vulnerability exists due to improper access control in the page picker backend logic for the pages field when handling a user-provided parent page or site. A remote user can provide the full path to an existing page to disclose sensitive information.

Only the existence of arbitrary pages and the value of their title field can be retrieved. Write actions are not affected.


Remediation

Install update from vendor's website.

References