CVE-2026-69127 Kirby: System path exposure from error messages in the REST API
Unauthenticated attackers can obtain full filesystem paths via unsanitized error messages in the Kirby CMS REST API.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-69127?
CVE-2026-69127 is a medium-severity vulnerability in getkirby kirby, published on 7 Aug 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.
Weakness: CWE-497
Which versions are affected by CVE-2026-69127?
4 open source packages ship an affected version, including getkirby/cms.
| Package | Affected | Fixed in |
|---|---|---|
getkirby/cms Packagist | All versions | 4.9.5 |
getkirby/cms Packagist | All versions | 4.9.5 |
getkirby/cms Packagist | From 5.0.0 | 5.5.2 |
getkirby/cms Packagist | From 5.0.0 | 5.5.2 |
How do I fix CVE-2026-69127?
Upgrade getkirby/cms to a fixed version for your release line: 4.9.5 or 5.5.2.
Is CVE-2026-69127 being exploited?
There is no known exploitation of CVE-2026-69127 in the wild and no public exploit code.
Sources
Also known as GHSA-rf2p-vh74-7vvh.