CVE-2026-69127

See a problem?
Please try reporting it to the source first.

Source

https://cve.org/CVERecord?id=CVE-2026-69127

Import Source

https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69127.json

JSON Data

https://api.osv.dev/v1/vulns/CVE-2026-69127

Aliases

GHSA-rf2p-vh74-7vvh

Published

2026-08-07T18:33:19.614Z

Modified

2026-08-09T03:47:28.775313333Z

Severity

6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator

Summary

Kirby: System path exposure from error messages in the REST API

Details

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.

Database specific

{
    "cwe_ids": [
        "CWE-497"
    ],
    "cna_assigner": "GitHub_M",
    "unresolved_ranges": [
        {
            "source": "AFFECTED_FIELD",
            "extracted_events": [
                {
                    "fixed": "4.9.5"
                }
            ]
        }
    ],
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/69xxx/CVE-2026-69127.json"
}

References

Affected packages

Git / github.com/getkirby/kirby

Affected ranges

Type

GIT

Repo

https://github.com/getkirby/kirby

Events

Introduced

2ff182ba39ddea19fa1615bd3733f734b5e53842

Fixed

81689c7f1471beb1fa9fb9c686f6f071f8671c3c

Database specific

{
    "source": "AFFECTED_FIELD",
    "extracted_events": [
        {
            "introduced": "5.0.0"
        },
        {
            "fixed": "5.5.2"
        }
    ]
}

Affected versions

5.*

5.0.0

5.0.1

5.0.2

5.0.3

5.0.4

5.1.0

5.1.1

5.1.2

5.1.3

5.1.4

5.2.0

5.2.1

5.2.2

5.2.3

5.3.0

5.3.1

5.3.2

5.3.3

5.4.0

5.4.1

5.4.2

5.4.3

5.4.4

5.5.0

5.5.1

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-69127.json"