CVE-2026-69127

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-69127
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69127.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-69127
Aliases
Published
2026-08-07T18:33:19Z
Modified
2026-09-18T03:30:16Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Kirby: System path exposure from error messages in the REST API
Details

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.

Database specific 
{
    "cna_assigner": "GitHub_M",
    "cwe_ids": [
        "CWE-497"
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69127.json",
    "unresolved_ranges": [
        {
            "extracted_events": [
                {
                    "fixed": "4.9.5"
                }
            ],
            "source": "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/getkirby/kirby

Affected ranges

Type
GIT
Repo
https://github.com/getkirby/kirby
Events
Introduced
2ff182ba39ddea19fa1615bd3733f734b5e53842
Fixed
81689c7f1471beb1fa9fb9c686f6f071f8671c3c
Database specific
Show details 
{
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.5.2"
        }
    ],
    "source": "AFFECTED_FIELD"
}

Affected versions

5.*
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4
5.2.0
5.2.1
5.2.2
5.2.3
5.3.0
5.3.1
5.3.2
5.3.3
5.4.0
5.4.1
5.4.2
5.4.3
5.4.4
5.5.0
5.5.1

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69127.json"