CVE-2026-69127
MediumCVSS 6.9Exploitation Probability (EPSS)
Low risk22th percentile - higher than 22% of all known CVEs
Summary
A vulnerability in the Kirby content management system prior to version 4.9.5 and from 5.0.0 through 5.5.1 causes the REST API error handler to return unsanitized PHP error messages, exposing the full filesystem path of the Kirby installation to unauthenticated API users. This affects all sites that have not disabled the REST API with the 'api' => false option. The issue is fixed in versions 4.9.5 and 5.5.2.
Risk Assessment
The risk is disclosure of the filesystem path, which may aid attackers in further attacks such as server structure reconnaissance.
Recommendation
Upgrade Kirby to version 4.9.5 or 5.5.2 and consider disabling the REST API if not needed.
Original NVD description (English source)
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.