CVE-2026-44174 Details
Description
Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowing attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password() (disclosing the password hash) or root() (disclosing the absolute filesystem path on the server) as well as methods that perform impactful actions such as loginPasswordless() (causing a privilege escalation to another user) or delete() (deleting all queried models in one go if the authenticated user has appropriate permissions). This issue has been fixed in versions 4.9.1 and 5.4.1.
A vulnerability allowing arbitrary method calls has been identified in Kirby, an open-source content management system. This issue affects Kirby versions 4.0.0 through 4.9.0 and 5.0.0 through 5.4.0. The vulnerability arises because the application did not properly validate model attributes used in collection queries. As a result, authenticated users could exploit this flaw to invoke arbitrary model methods through the REST API, potentially leading to the disclosure of sensitive information or unauthorized actions. Methods that could be called include password() and root(), which reveal the password hash and absolute filesystem path, respectively, as well as loginPasswordless(), which could escalate privileges to another user, and delete(), which could remove all queried models if the user had the necessary permissions.
Users are advised to upgrade to Kirby versions 4.9.1 or 5.4.1, both of which address this vulnerability by validating model attributes in collection queries and restricting access to sensitive methods. Instructions for downloading these versions are available on the Kirby GitHub releases page.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 18, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkirby/kirby/releases/tag/4.9.1 | [email protected] | Release NotesVendor |
| https://github.com/getkirby/kirby/releases/tag/5.4.1 | [email protected] | Release NotesVendor |
| https://github.com/getkirby/kirby/security/advisories/GHSA-86rh-h242-j8xp | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-470 | Use of Externally-Controlled Input to Select Classes or Code ('Unsafe Reflection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kirby | <= 4.9.0 (semver) >= 5.0.0, <= 5.4.0 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 18, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |