Arbitrary Method Injection in Kirby CMS by GetKirby

CVE-2026-44174

What is CVE-2026-44174?

Kirby, an open-source content management system, was found to lack validation for model attributes in its collection queries. This oversight permitted attackers to inject arbitrary model methods, potentially exposing sensitive information like password hashes or filesystem paths. Additionally, harmful actions such as privilege escalation and mass deletion of models could be executed if the attacker had sufficient permissions. Versions 4.9.1 and 5.4.1 address these crucial issues, underscoring the importance of upgrading to safeguard against such risks.

References