CVE-2026-50188 Details
Description
Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::request(), Remote::get(), and Remote::post(), to send outgoing HTTP requests with untrusted data in the headers option could allow newline characters in a header value to inject a separate unintended request header to the remote service. This issue is fixed in versions 4.9.4 and 5.4.4.
A request header injection vulnerability has been identified in Kirby, an open-source content management system. This issue affects Kirby versions 4.9.3 and prior, as well as 5.0.0 through 5.4.3. The vulnerability arises in sites and plugins that use the Kirby Http Remote class to send outgoing HTTP requests, particularly when untrusted data is included in the headers option. The flaw allows newline characters in header values to inject unintended request headers to the remote service, potentially overwriting existing headers or introducing new ones that could be exploited.
Users are advised to update Kirby to version 4.9.4 or 5.4.4, both of which include the necessary fix. In these patched versions, Kirby now removes carriage-return and line-feed characters from header values before they are sent in the request, preventing the injection of additional headers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkirby/kirby/commit/aa33414e1669e866cdd6f4decfae2a669e8bb828 | [email protected] | Source CodeVendor |
| https://github.com/getkirby/kirby/commit/fad9cbd22c73ed0fbd3aaf62310a8dcacfc007cd | [email protected] | Source CodeVendor |
| https://github.com/getkirby/kirby/releases/tag/4.9.4 | [email protected] | Release NotesVendor |
| https://github.com/getkirby/kirby/releases/tag/5.4.4 | [email protected] | AdvisoryBundleRelease NotesVendor |
| https://github.com/getkirby/kirby/security/advisories/GHSA-4v4h-m2qq-ppgw | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-113 | Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting') | [email protected] |
| CWE-93 | Improper Neutralization of CRLF Sequences ('CRLF Injection') | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kirby | <= 4.9.3 (semver) >= 5.0.0, <= 5.4.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |