CVE-2026-69127
Kirby: System path exposure from error messages in the REST API
CVSS Score
0.0
EPSS Score
0.3%
EPSS Percentile
21th
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.
| CWE | CWE-497 |
| Vendor | getkirby |
| Product | kirby |
| Published | Aug 7, 2026 |
| Last Updated | Aug 11, 2026 |
Stay Ahead of the Next One
Get instant alerts for getkirby kirby
Be the first to know when new unknown vulnerabilities affecting getkirby kirby are published — delivered to Slack, Telegram or Discord.
Get Free Alerts →
Free · No credit card · 60 sec setup
Affected Versions
getkirby / kirby
< 4.9.5 >= 5.0.0, < 5.5.2