Unrestricted PHP Error Message Exposure in Kirby CMS Versions
CVE-2026-69127
6.9MEDIUM
What is CVE-2026-69127?
Kirby is an open-source content management system that, prior to version 4.9.5 and between versions 5.0.0 and 5.5.1, is susceptible to an information exposure vulnerability. The REST API error handler may return unsanitized PHP error messages, which can reveal the full filesystem path of the Kirby installation to unauthenticated users. This situation poses a risk for all Kirby sites where the REST API has not been disabled using the 'api' => false option. This issue has been addressed in versions 4.9.5 and 5.5.2.
Affected Version(s)
kirby < 4.9.5 < 4.9.5
kirby >= 5.0.0, < 5.5.2 < 5.0.0, 5.5.2