Security Flaw in Kirby CMS Affects File Access Controls
CVE-2026-54004

6.3MEDIUM

Key Information:

Vendor

Getkirby

Status
Kirby
Vendor
CVE Published:
9 July 2026

What is CVE-2026-54004?

Kirby CMS, an open-source content management system, has a vulnerability that affects sites with content.fileRedirects enabled. This flaw allows unauthorized users to access files stored on top-level draft pages, bypassing page access permissions and preview tokens. As a result, sensitive draft file contents could be disclosed to unauthenticated requests. The issue has been resolved in versions 4.9.4 and 5.4.4.

Affected Version(s)

kirby < 4.9.4 < 4.9.4

kirby >= 5.0.0, < 5.4.4 < 5.0.0, 5.4.4

References

https://github.com/getkirby/kirby/security/advisories/GHS...
x_refsource_CONFIRM
https://github.com/getkirby/kirby/commit/5b9a0ed587575e39...
x_refsource_MISC
https://github.com/getkirby/kirby/commit/bc721080cd8dd4dc...
x_refsource_MISC

CVSS V4

Score:
6.3
Severity:
MEDIUM
Confidentiality:
Low
Integrity:
None
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
Physical
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.