Exposure of Sensitive System Information to an Unauthorized Control Sphere in Kirby - #VU138445
Published: July 20, 2026
Vulnerability identifier: #VU138445
CSH Severity: Medium
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green
CVE-ID: N/A
CWE-ID: CWE-497
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Ian Stewart
Affected software:
Kirby
Kirby
Detailed vulnerability description
The vulnerability allows a remote attacker to disclose sensitive system information.
The vulnerability exists due to exposure of sensitive system information in the REST API error handler when handling crafted API requests that trigger internal errors. A remote attacker can send a specially crafted request to disclose sensitive system information.
The issue can expose the full filesystem path of the installation, and unauthenticated API access is sufficient when the REST API is enabled.
Remediation
Install security update from vendor's website.