Kirby vulnerabilities

A vulnerability in the Kirby content management system allows a remote attacker to bypass local IP checks and install the Panel and create the first admin account. The issue affects versions prior to 4.9.4 and 5.4.4 when the server runs behind a reverse proxy that sets the Forwarded, X-Client-IP, or X-Real-IP request headers.

A vulnerability in the Kirby content management system prior to version 4.9.5 and from 5.0.0 through 5.5.1 causes the REST API error handler to return unsanitized PHP error messages, exposing the full filesystem path of the Kirby installation to unauthenticated API users. This affects all sites that have not disabled the REST API with the 'api' => false option. The issue is fixed in versions 4.9.5 and 5.5.2.

In Kirby CMS before versions 4.9.4 and 5.4.4, users with the pages.access permission disabled could retrieve full content and metadata of any published page via the /api/site/find endpoint by knowing page IDs or UUIDs. This vulnerability allowed unauthorized access to pages that should have been protected.

In Kirby (content management system) versions prior to 4.9.0 and 5.4.0, the `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API.

Kirby prior to versions 4.9.0 and 5.4.0 does not gate read access to site, user and role information by permissions, allowing unauthorized users to access this data.

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.

In Kirby 2.5.12, a CSRF vulnerability was found in the delete page functionality. A remote attacker can craft a malicious CSRF page and force the user to delete a page.