CVE-2026-69127CWE-497

CVE-2026-69127

published August 7, 2026

CVSS
6.9
EPSS
1%
Percentile
52.6
In the wild
Unconfirmed
What it is

Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.

The record
Technical detail
CVSS
6.9 · NONE
CVSS v4.0
Not supplied
EPSS
0.00699 · 52.6th percentile
Weakness
CWE-497 · Exposure of Sensitive System Information to an Unauthorized Control Sphere
Published
2026-08-07T23:18Z
References (3)
https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0 · [email protected]https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451 · [email protected]https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh · [email protected]
EPSS history
Timeline
  • 07 AUG 18:33Z
    Kirby: System path exposure from error messages in the REST API
    cvelistv5