CVE-2026-54003

Summary of CVE-2026-54003 (Kirby CMS) : Affected Kirby installations with no configured user accounts, running behind a reverse proxy that sets Forwarded, X-Client-IP, or X-Real-IP headers could allow remote attackers to install the Panel and create the first admin user. This occurs on releases p...

GHSA-WHXW-24JC-CWMV Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

TL;DR This vulnerability affects Kirby sites that have no configured user accounts and are running on publicly accessible servers behind a reverse proxy that sets the Forwarded: for=..., X-Client-IP, or X-Real-IP request header. It was possible to install the Panel = create the first admin user i...

Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header

TL;DR This vulnerability affects Kirby sites that have no configured user accounts and are running on publicly accessible servers behind a reverse proxy that sets the Forwarded: for=..., X-Client-IP, or X-Real-IP request header. It was possible to install the Panel = create the first admin user i...

PT-2026-50724

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.4 Kirby versions prior to 5.4.4 Description An external initialization issue exists in the Kirby Panel and REST API. This occurs when a site has no configured user accounts and is hosted on a publicly accessible...

PT-2026-44153

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.1 Kirby versions prior to 5.4.1 Description Missing authorization in the content-locking feature allows authenticated users to access sensitive information. The system records which user has a model open for editing...

EUVD-2022-1926

Malicious code in bioql PyPI...

Kirby XSS Vulnerability

A cross-site Scripting XSS vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file...

GHSA-275C-V3RC-XGHX Kirby XSS Vulnerability

A cross-site Scripting XSS vulnerability in Kirby Panel before 2.3.3, 2.4.x before 2.4.2, and 2.5.x before 2.5.7 exists when displaying a specially prepared SVG document that has been uploaded as a content file...

CVE-2021-29460

Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like "" tags. The direct link to that file can be sent to other users or visitors of the site. If the victim opens that link in a browser where they are logged in to...

CVE-2021-29460: Improper Neutralization of Input During Web Page Generation

Kirby is an open source CMS. An editor with write access to the Kirby Panel can upload an SVG file that contains harmful content like...

CVE-2020-26255

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of...

CVE-2020-26255

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of...

Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5

Impact An editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors...

GHSA-G3H8-CG9X-47QW Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5

Impact An editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors...

PT-2020-16381

Name of the Vulnerable Software and Affected Versions Kirby CMS versions prior to 3.4.5 Kirby Panel versions prior to 2.5.14 Description An editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This issue is critical if there are potential attackers...

CVE-2020-26255: Unrestricted Upload of File with Dangerous Type

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of...

PT-2020-16379

Name of the Vulnerable Software and Affected Versions Kirby CMS versions prior to 3.3.6 Kirby Panel versions prior to 2.5.14 Description The issue concerns a vulnerability in Kirby CMS and Kirby Panel where the admin panel may be accessed if hosted on a .dev domain. This is due to an outdated...

CVE-2020-26253: Origin Validation Error

Kirby is a CMS. In Kirby CMS getkirby/cms before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Pane...

Kirby Access Control Error Vulnerability

Kirby is a file-based content management system CMS. A security vulnerability exists in Kirby CMS versions prior to 3.3.6 and Kirby Panel versions prior to 2.5.14, which stems from the fact that the admin panel may be accessible if hosted in a .dev domain. To protect new installations on public...

Kirby Panel Cross-Site Scripting Vulnerability

Kirby is a file-based CMS Content Management System system. panel is one of the control panel components. A cross-site scripting vulnerability exists in Kirby Panel versions prior to 2.3.3, 2.4.x versions prior to 2.4.2 and 2.5.x versions prior to 2.5.7. A remote attacker can exploit this...