CVE-2026-69127: Kirby: System path exposure from error messages in the REST API
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kirbyto a version that resolves this vulnerability.Fixed in 4.9.5 - Upgrade
Upgrade
Kirbyto a version that resolves this vulnerability.Fixed in 5.5.2 - Configuration
Disable the REST API in Kirby configuration by setting 'api' => false, to prevent unauthenticated API users from reaching the REST API error handler.
Kirby REST API api = false
Event History
Frequently Asked Questions
What is the severity of CVE-2026-69127?
CVE-2026-69127 has a risk score of 16, indicating a medium severity vulnerability.
How do I fix CVE-2026-69127?
To fix CVE-2026-69127, upgrade to Kirby version 4.9.5 or any version from 5.5.2 onwards.
What types of systems are affected by CVE-2026-69127?
CVE-2026-69127 affects all Kubernetes sites that use versions prior to 4.9.5 and from 5.0.0 to 5.5.1.
What kind of information is exposed in CVE-2026-69127?
CVE-2026-69127 exposes the full filesystem path of the Kirby installation through unsanitized error messages in the REST API.
Is user authentication a factor in CVE-2026-69127?
CVE-2026-69127 can be exploited by unauthenticated API users, making it critical to address.