CVE-2026-44177 Details
Description
Kirby is an open-source content management system. In versions 5.3.0 and above but prior to 5.4.1, Kirby did not correctly validate the provided user ID, resulting in a path traversal vulnerability. Version 5.3.0 introduced a performance improvement to the Users collection that loaded user objects lazily when first needed. Users were queried by their ID, which was then used to locate the corresponding account directory under site/accounts. This affected the authentication API (accessible to unauthenticated requests), the users API (accessible only to authenticated users), and any other place that uses $users->find() to look up an individual user by a request-provided email or ID. As a result, an attacker could trigger arbitrary PHP file inclusion of files named index.php (for example, the main PHP files of plugins), the impact of which depends on the logic those files contain. It also allowed probing for the existence of arbitrary directories on the server, letting attackers fingerprint the server and site setup, including installed plugins and the content structure. This issue has been fixed in version 5.4.1.
A path traversal vulnerability allowing arbitrary PHP file inclusion has been identified in Kirby, an open-source content management system. This issue affects versions 5.3.0 prior to 5.4.1. The vulnerability arises because the user ID provided during lookup was not properly validated, enabling attackers to traverse directories and include PHP files, such as plugin files, which could be executed on the server. The flaw is present in the authentication API, the users API, and any functionality that uses the $users->find() method to retrieve user information by email or ID. Additionally, the vulnerability allows for probing the existence of arbitrary directories on the server, which could be used to gather information about the server and site setup, including installed plugins and content structure.
Users are advised to update Kirby to version 5.4.1 or later, where this vulnerability has been patched. In the updated version, additional checks have been implemented to validate user IDs and ensure that the corresponding account directory paths are contained within the designated accounts directory.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 16, 2026CISA-ADP
Assessed Jul 17, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkirby/kirby/releases/tag/5.4.1 | [email protected] | Release NotesVendor |
| https://github.com/getkirby/kirby/security/advisories/GHSA-9hx7-c53c-v6x8 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-22 | Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') | [email protected] |
| CWE-98 | Improper Control of Filename for Include/Require Statement in PHP Program ('PHP Remote File Inclusion') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kirby | >= 5.3.0, < 5.4.1 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 17, 2026 | CVE Modified | CISA-ADP |
| Jul 16, 2026 | New CVE Received | [email protected] |