CVE-2026-54003
CriticalCVSS 9.1Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
A vulnerability in the Kirby content management system allows a remote attacker to bypass local IP checks and install the Panel and create the first admin account. The issue affects versions prior to 4.9.4 and 5.4.4 when the server runs behind a reverse proxy that sets the Forwarded, X-Client-IP, or X-Real-IP request headers.
Risk Assessment
The risk is that a remote attacker can gain unauthorized control over the Kirby system, potentially leading to full compromise of the website and its data.
Recommendation
Update Kirby to version 4.9.4 or 5.4.4 immediately. As a temporary workaround, disable support for the Forwarded, X-Client-IP, and X-Real-IP headers in the reverse proxy configuration.
Original NVD description (English source)
Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4.