getkirby has 13 CVEs on record between 2022 and 2026. Cadence is steady at roughly 5 per quarter. The busiest recent month was June 2026 with 7. The median CVSS is 4.3 (medium), with 1 rated critical. None have a confirmed exploitation report. The most common weakness class is CWE-862 (4). Most affected products: getkirby/cms (11), Kirby (2).
CVEs per month
Last 12 months, by publish date
- Exploited share
- 0% vs 1% corpus
- Median CVSS
- 4.3
- Publish → KEV
- —
- Last 90 days
- 5 prev 7
Worst active — by depth score
CVE-2026-54003CriticalKirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header52CVE-2026-75594HighKirby is an open-source content management system41CVE-2026-71415HighKirby is an open-source content management system41CVE-2026-54005HighKirby: `pages.access` permission is not checked in the `site/find` REST API route41CVE-2026-54002HighKirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`41
getkirby vulnerabilities
CVEs affecting getkirby, newest first. Open any entry for full detail, references, and exploit status.
13 CVEsRSS
CVE-2026-108924Medium· 4.3PoCA vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3
A vulnerability was identified in getkirby Kirby up to 4.9.5/5.5.3. Affected by this issue is the function OptionsQuery::resolve of the file src/Option/OptionsQuery.php of the component Dynamic Option Generation. The manipulation leads t…
CVE-2026-75592MediumKirby is an open-source content management system
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Ki…
CVE-2026-75594HighKirby is an open-source content management system
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated pare…
CVE-2026-71415HighKirby is an open-source content management system
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Ap…
CVE-2026-69127MediumKirby is an open-source content management system
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauth…
CVE-2026-49274MediumKirby: `pages.access` permission is not checked in the pages picker for parent pages
Kirby: `pages.access` permission is not checked in the pages picker for parent pages
CVE-2026-49276HighKirby: Self cross-site scripting (self-XSS) in the writer field
Kirby: Self cross-site scripting (self-XSS) in the writer field
CVE-2026-50188MediumKirby: Request header injection in `Http\Remote`
Kirby: Request header injection in `Http\Remote`
CVE-2026-54002HighKirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
CVE-2026-54004MediumKirby: Access to files of top-level drafts is not protected by permissions
Kirby: Access to files of top-level drafts is not protected by permissions
CVE-2026-54003CriticalKirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
CVE-2026-54005HighKirby: `pages.access` permission is not checked in the `site/find` REST API route
Kirby: `pages.access` permission is not checked in the `site/find` REST API route
CVE-2018-14519Medium· 4.3An issue was discovered in Kirby 2.5.12
An issue was discovered in Kirby 2.5.12. The delete page functionality suffers from a CSRF flaw. A remote attacker can craft a malicious CSRF page and force the user to delete a page.