CVE-2026-69127 in Kirby
Summary
by MITRE • 08/07/2026
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 08/07/2026
This vulnerability resides within the REST API error handling mechanism of the Kirby content management system, representing a critical information disclosure flaw that exposes sensitive system information to unauthorized users. The vulnerability exists in specific version ranges where the error handler fails to sanitize PHP error messages before returning them to API consumers, thereby leaking the complete filesystem path of the Kirby installation. This type of information disclosure directly aligns with CWE-209, which addresses the exposure of error handling information that can aid attackers in understanding system architecture and planning further attacks.
The technical implementation of this flaw occurs when the REST API encounters an error condition and attempts to return diagnostic information to the requesting client. Without proper sanitization, PHP error messages contain detailed path information that reveals the absolute directory structure where Kirby is installed on the server. This exposure can occur even when authentication is not required for the API endpoints, making the vulnerability accessible to unauthenticated users who can simply make API requests to trigger the error conditions. The impact is particularly severe because filesystem paths often contain sensitive information about the hosting environment, including directory names that might reveal system configuration details or server structure.
The operational consequences of this vulnerability extend beyond simple information disclosure, as it significantly weakens the security posture of affected systems by providing attackers with crucial reconnaissance data. An attacker who discovers this path exposure can potentially use this information to craft more sophisticated attacks targeting specific file locations, understand the system's directory structure, or identify potential attack vectors through path-based reconnaissance. This vulnerability particularly affects installations that have not explicitly disabled the REST API, meaning that by default, all Kirby sites with the API enabled are at risk unless properly configured. The exploitation requires minimal effort and can be automated, making it attractive to threat actors seeking to gather intelligence before launching more targeted attacks.
The fix implemented in versions 4.9.5 and 5.5.2 addresses this vulnerability through proper error message sanitization within the REST API error handling code. This remediation ensures that when API errors occur, sensitive filesystem path information is stripped from error responses before being sent to clients. Organizations should immediately upgrade to these patched versions to eliminate the risk of path exposure. Additionally, system administrators should review their current configurations to ensure that the REST API is only enabled when necessary and consider implementing additional security controls such as rate limiting and IP restrictions for API endpoints. This vulnerability demonstrates the importance of proper error handling practices in web applications and aligns with ATT&CK technique T1212 which covers the exploitation of information disclosure vulnerabilities to gather system information for further attack planning.