HTTP response splitting in Kirby - CVE-2026-50188
Published: July 20, 2026
Vulnerability identifier: #VU138441
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2026-50188
CWE-ID: CWE-113
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Ian Stewart
Affected software:
Kirby
Kirby
Detailed vulnerability description
The vulnerability allows a remote attacker to inject or override HTTP headers in outgoing requests.
The vulnerability exists due to improper neutralization of CRLF sequences in Kirby\Http\Remote when processing user-controlled header values. A remote attacker can supply header values containing newline characters to inject or override HTTP headers in outgoing requests.
The issue is only exposed when custom code or plugins pass untrusted input into the headers option, and it targets the remote service that receives the outgoing request.
How to mitigate CVE-2026-50188
Install security update from vendor's website.