CVE-2026-54004CWE-862

Kirby: Access to files of top-level drafts is not protected by permissions

Medium · published July 9, 2026

CVSS v4.0
6.3
EPSS
0%
Percentile
41.6
In the wild
Unconfirmed
What it is

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents. This issue is fixed in versions 4.9.4 and 5.4.4.

The record
Technical detail
CVSS v4.0
6.3 · MEDIUM
Vector
CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
EPSS
0.00496 · 41.6th percentile
Weakness
CWE-862 · Missing Authorization
Published
2026-07-09T18:42Z
EPSS history
Timeline
  • 09 JUL 18:42Z
    Kirby: Access to files of top-level drafts is not protected by permissions
    cvelistv5