CVE-2026-54003 Details
Description
Kirby is an open-source content management system. Prior to 4.9.4 and from 5.4.4, Kirby sites with no configured user accounts that run on publicly accessible servers behind a reverse proxy setting the Forwarded, X-Client-IP, or X-Real-IP request header could allow remote attackers to install the Panel and create the first admin user because local-IP checks trusted those headers incorrectly. This issue is fixed in versions 4.9.4 and 5.4.4.
A vulnerability exists in Kirby, an open-source content management system, in versions prior to 4.9.4 and from 5.0.0 through 5.4.3. The issue arises on sites with no user accounts, running on publicly accessible servers behind a reverse proxy that adds `Forwarded`, `X-Client-IP`, or `X-Real-IP` headers. This misconfiguration allows remote attackers to install the Kirby Panel and create the first admin user, as the local IP checks incorrectly trust these headers. The vulnerability is not present if the site uses a reverse proxy that sets `X-Forwarded-For` or `Client-IP` headers instead.
Upgrade to Kirby version 4.9.4 or 5.4.4. In these versions, the `isLocal()` check has been fixed to properly account for the `Forwarded`, `X-Client-IP`, and `X-Real-IP` headers.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Jul 9, 2026CISA-ADP
Assessed Jul 9, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/getkirby/kirby/commit/1c7fee90e49153cf9ca4a6ec17481d25fbedc48d | [email protected] | Source CodeVendor |
| https://github.com/getkirby/kirby/commit/3423f66c01dbc0455862e23ee699d2aa469f3234 | [email protected] | Source CodeVendor |
| https://github.com/getkirby/kirby/commit/66a3a14bf0892d320723ba766cd5f1d33a51d15b | [email protected] | Source CodeVendor |
| https://github.com/getkirby/kirby/commit/ab992dc149610b90e337c2955ab6ccb7f72ffb3a | [email protected] | Source CodeVendor |
| https://github.com/getkirby/kirby/pull/8166 | [email protected] | Issue TrackingVendor |
| https://github.com/getkirby/kirby/releases/tag/4.9.4 | [email protected] | Release NotesVendor |
| https://github.com/getkirby/kirby/releases/tag/5.4.4 | [email protected] | AdvisoryBundleRelease NotesVendor |
| https://github.com/getkirby/kirby/security/advisories/GHSA-whxw-24jc-cwmv | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-454 | External Initialization of Trusted Variables or Data Stores | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Kirby | <= 4.9.3 (semver) >= 5.0.0, <= 5.4.3 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Jul 9, 2026 | CVE Modified | CISA-ADP |
| Jul 9, 2026 | New CVE Received | [email protected] |