Composer getkirby/cms has 51 known advisories in the phpwarden feed. Feed 2026.10.29.4, updated 2026-10-29.
| CVE | Title | Severity | CVSS | Affected | Fixed in |
|---|---|---|---|---|---|
| CVE-2021-29460 | Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby | high | 7.6 | <3.5.4 | 3.5.4 |
| CVE-2017-16807 | Kirby XSS Vulnerability | medium | 5.4 | <2.3.3 or >=2.4 and <2.4.2 or >=2.5 and <2.5.7 | 2.3.3, 2.4.2, 2.5.7 |
| CVE-2026-44177 | Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup | high | 0.0 | >=5.3.0 and <5.4.1 | 5.4.1 |
| CVE-2023-38490 | XML External Entity (XXE) vulnerability in the XML data handler | medium | 6.8 | <3.5.8.3 or >=3.6.0 and <3.6.6.3 or >=3.7.0 and <3.7.5.2 or >=3.8.0 and <3.8.4.1 or >=3.9.0 and <3.9.6 | 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1 |
| CVE-2020-26255 | Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5 | medium | 6.8 | >=3.0.0 and <3.4.5 | 3.4.5 |
| CVE-2023-38492 | Denial of service from unlimited password lengths | medium | 5.3 | <3.5.8.3 or >=3.6.0 and <3.6.6.3 or >=3.7.0 and <3.7.5.2 or >=3.8.0 and <3.8.4.1 or >=3.9.0 and <3.9.6 | 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1 |
| CVE-2024-26483 | Kirby vulnerable to unrestricted file upload of user avatar images | medium | 4.6 | <3.6.6.5 or >=3.7.0 and <3.7.5.4 or >=3.8.0 and <3.8.4.3 or >=3.9.0 and <3.9.8.1 or >=3.10.0 and <3.10.0.1 or >=4.0.0 and <4.1.1 | 3.6.6.5, 3.7.5.4, 3.8.4.3, 3.9.8.1 |
| CVE-2021-41252 | Cross-site scripting (XSS) from writer field content in the site frontend | medium | 5.4 | >=3.5.0 and <3.5.8 | 3.5.8 |
| CVE-2023-38488 | Field injection in the KirbyData text storage handler | high | 7.1 | <3.5.8.3 or >=3.6.0 and <3.6.6.3 or >=3.7.0 and <3.7.5.2 or >=3.8.0 and <3.8.4.1 or >=3.9.0 and <3.9.6 | 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1 |
| CVE-2022-36037 | Cross-site scripting from dynamic options in the multiselect field | medium | 5.9 | <3.5.8.1 | 3.5.8.1 |
| CVE-2023-38489 | Insufficient Session Expiration after a password change | high | 7.3 | <3.5.8.3 or >=3.6.0 and <3.6.6.3 or >=3.7.0 and <3.7.5.2 or >=3.8.0 and <3.8.4.1 or >=3.9.0 and <3.9.6 | 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1 |
| CVE-2021-41258 | Cross-site scripting (XSS) from image block content in the site frontend | medium | 5.4 | >=3.5.0 and <3.5.8 | 3.5.8 |
| CVE-2022-39315 | Kirby CMS vulnerable to user enumeration in the brute force protection | medium | 6.5 | <3.5.8.2 or >=3.6.0 and <3.6.6.2 or >=3.7.0 and <3.7.5.1 or >=3.8.0 and <3.8.1 | 3.5.8.2, 3.6.6.2, 3.7.5.1, 3.8.1 |
| CVE-2026-75594 | Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling | high | 0.0 | <4.9.5 or >=5.0.0 and <5.5.2 | 4.9.5, 5.5.2 |
| CVE-2026-54003 | Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header | critical | 0.0 | <4.9.4 or >=5.0.0-alpha.1 and <5.4.4 | 4.9.4, 5.4.4 |
| CVE-2018-14520 | Kirby CMS 2.5.12 Cross-site Scripting | medium | 5.4 | <=2.5.12 | – |
| CVE-2026-69127 | Kirby: System path exposure from error messages in the REST API | medium | 0.0 | <4.9.5 or >=5.0.0 and <5.5.2 | 4.9.5, 5.5.2 |
| CVE-2026-75592 | Kirby: Access to image files outside of the site root via path traversal in the media handling | medium | 0.0 | <4.9.5 or >=5.0.0 and <5.5.2 | 4.9.5, 5.5.2 |
| CVE-2023-38491 | Cross-site scripting (XSS) from MIME type auto-detection of uploaded files | medium | 5.7 | <3.5.8.3 or >=3.6.0 and <3.6.6.3 or >=3.7.0 and <3.7.5.2 or >=3.8.0 and <3.8.4.1 or >=3.9.0 and <3.9.6 | 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1 |
| CVE-2025-31493 | Kirby vulnerable to path traversal of collection names during file system lookup | medium | 0.0 | <3.9.8.3 or >=3.10.0 and <3.10.1.2 or >=4.0.0 and <4.7.1 | 3.9.8.3, 3.10.1.2, 4.7.1 |
| CVE-2025-30207 | Kirby vulnerable to path traversal in the router for PHP's built-in server | low | 0.0 | <3.9.8.3 or >=3.10.0 and <3.10.1.2 or >=4.0.0 and <4.7.1 | 3.9.8.3, 3.10.1.2, 4.7.1 |
| CVE-2020-26253 | Kirby .dev domains and some reverse proxy setups were treated as local | medium | 6.8 | >=3.0.0 and <3.3.6 | 3.3.6 |
| CVE-2026-54002 | Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()` | high | 0.0 | <4.9.4 or >=5.0.0-alpha.1 and <5.4.4 | 4.9.4, 5.4.4 |
| CVE-2026-45368 | Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend | high | 0.0 | <4.9.1 or >=5.0.0 and <5.4.1 | 4.9.1, 5.4.1 |
| CVE-2021-32735 | Cross-site scripting (XSS) from field and configuration text displayed in the Panel | high | 7.1 | <3.5.7 | 3.5.7 |
| CVE-2018-14519 | Kirby CMS 2.5.12 Cross-site Request Forgery | medium | 4.3 | <=2.5.12 | – |
| CVE-2026-54004 | Kirby: Access to files of top-level drafts is not protected by permissions | medium | 0.0 | <4.9.4 or >=5.0.0-alpha.1 and <5.4.4 | 4.9.4, 5.4.4 |
| CVE-2026-44174 | Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints | high | 0.0 | <4.9.1 or >=5.0.0 and <5.4.1 | 4.9.1, 5.4.1 |
| CVE-2026-49274 | Kirby: `pages.access` permission is not checked in the pages picker for parent pages | medium | 0.0 | <4.9.4 or >=5.0.0-alpha.1 and <5.4.4 | 4.9.4, 5.4.4 |
| CVE-2024-41964 | Kirby has insufficient permission checks in the language settings | high | 8.1 | <3.6.6.6 or >=3.7.0 and <3.7.5.5 or >=3.8.0 and <3.8.4.4 or >=3.9.0 and <3.9.8.2 or >=3.10.0 and <3.10.1.1 or >=4.0.0 and <4.3.1 | 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2 |
| CVE-2026-50188 | Kirby: Request header injection in `Http\Remote` | medium | 0.0 | <4.9.4 or >=5.0.0-alpha.1 and <5.4.4 | 4.9.4, 5.4.4 |
| CVE-2026-49276 | Kirby: Self cross-site scripting (self-XSS) in the writer field | high | 0.0 | <4.9.4 or >=5.0.0-alpha.1 and <5.4.4 | 4.9.4, 5.4.4 |
| CVE-2026-44175 | Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend | high | 0.0 | <4.9.1 or >=5.0.0 and <5.4.1 | 4.9.1, 5.4.1 |
| CVE-2022-39314 | Kirby CMS vulnerable to user enumeration in the code-based login and password reset forms | medium | 4.8 | >=3.5.0 and <3.5.8.2 or >=3.6.0 and <3.6.6.2 or >=3.7.0 and <3.7.5.1 or >=3.8.0 and <3.8.1 | 3.5.8.2, 3.6.6.2, 3.7.5.1, 3.8.1 |
| CVE-2026-54005 | Kirby: `pages.access` permission is not checked in the `site/find` REST API route | high | 0.0 | <4.9.4 or >=5.0.0-alpha.1 and <5.4.4 | 4.9.4, 5.4.4 |
| CVE-2026-71415 | Kirby: File upload permissions are not checked during processing of chunk data | high | 0.0 | >=5.0.0 and <5.5.2 | 5.5.2 |
| CVE-2024-26481 | Kirby vulnerable to self cross-site scripting (self-XSS) in the URL field | medium | 4.2 | <3.6.6.5 or >=3.7.0 and <3.7.5.4 or >=3.8.0 and <3.8.4.3 or >=3.9.0 and <3.9.8.1 or >=3.10.0 and <3.10.0.1 or >=4.0.0 and <4.1.1 | 3.6.6.5, 3.7.5.4, 3.8.4.3, 3.9.8.1 |
| CVE-2026-44176 | Kirby CMS's `pages.access` permission is not checked during rendering of page drafts | medium | 0.0 | <4.9.1 or >=5.0.0 and <5.4.1 | 4.9.1, 5.4.1 |
| CVE-2026-45334 | Kirby CMS's content locks disclose IDs and emails of inaccessible users from `users.access/list` permissions | medium | 0.0 | <4.9.1 or >=5.0.0 and <5.4.1 | 4.9.1, 5.4.1 |
| CVE-2026-41325 | Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection | high | 0.0 | <4.9.0 or >=5.0.0 and <5.4.0 | 4.9.0, 5.4.0 |
| CVE-2024-27087 | Kirby vulnerable to Cross-site scripting (XSS) in the link field "Custom" type | medium | 4.6 | >=4.0.0 and <4.1.1 | 4.1.1 |
| CVE-2026-32870 | Kirby has XML injection in its XML creator toolkit | medium | 0.0 | <4.9.0 or >=5.0.0 and <5.4.0 | 4.9.0, 5.4.0 |
| CVE-2026-34587 | Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering | high | 8.1 | <4.9.0 or >=5.0.0 and <5.4.0 | 4.9.0, 5.4.0 |
| CVE-2026-42137 | Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API | high | 0.0 | <4.9.0 or >=5.0.0 and <5.4.0 | 4.9.0, 5.4.0 |
| CVE-2026-40099 | Kirby's page creation API bypasses the changeStatus permission check via unfiltered isDraft parameter | medium | 0.0 | <4.9.0 or >=5.0.0 and <5.4.0 | 4.9.0, 5.4.0 |
| CVE-2026-42174 | Kirby CMS doesn't gate user avatar creation, replacement and deletion with user update permissions | medium | 0.0 | <4.9.0 or >=5.0.0 and <5.4.0 | 4.9.0, 5.4.0 |
| CVE-2026-42069 | Kirby CMS's read access to site, user and role information is not gated by permissions | high | 0.0 | <4.9.0 or >=5.0.0 and <5.4.0 | 4.9.0, 5.4.0 |
| CVE-2026-21896 | Kirby is missing permission checks in the content changes API | medium | 0.0 | >=5.0.0 and <5.2.2 | 5.2.2 |
| CVE-2025-65012 | Kirby CMS has cross-site scripting (XSS) in the changes dialog | medium | 0.0 | >=5.0.0 and <5.1.4 | 5.1.4 |
| CVE-2026-42051 | Kirby CMS's system API endpoint leaks installed version and license data to authenticated users | medium | 0.0 | <4.9.0 or >=5.0.0 and <5.4.0 | 4.9.0, 5.4.0 |
| GHSA-rv3r-vqjj-8c76 | Cross-site scripting from content entered in the tags and multiselect fields | high | 7.1 | >=3.5.7 and <3.5.8.1 or >=3.6.0 and <3.6.6.1 or >=3.7.0 and <3.7.4 | 3.5.8.1, 3.6.6.1, 3.7.4 |
Find out in one command. phpwarden checks your composer.lock against this advisory and 20,000+ others, ranked by real-world exploitation (CISA KEV + EPSS). Free, offline, open data.
# PHP projects (recommended) composer require --dev phpwarden/phpwarden # then vendor/bin/phpwarden deps composer.lock # or, without Composer pipx install phpwarden && phpwarden deps composer.lock
Or keep it checked automatically: GitHub Action · pre-commit hook · GitLab CI · Laravel artisan command
Install docs How findings are ranked