Cloudanix VulnDB

CVE-2026-44177

High · 8.2

Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup

CVSS

8.2

EPSS

1.8%

Published

May 26, 2026

CISA due date

—

The record

In affected releases, Kirby did not correctly validate the provided user ID, causing a path traversal vulnerability. This vulnerability results in the following impact: - Arbitrary PHP file inclusion of files with the filename `index.php` (e.g. the main PHP files of plugins), the impact of which depends on the contents and logic inside the includable files. - Probing of the existence of arbitrary directories on the server, which can allow attackers to fingerprint the server and site setup, including installed plugins and the content structure.

Affected packages

Ecosystem Package Introduced Fixed

Related vulnerabilities