CVE-2026-44174

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.1 Kirby versions prior to 5.4.1

Description Kirby failed to validate model attributes used in collection queries, enabling authenticated Panel users to execute arbitrary model methods. This arbitrary method call, a form of arbitrary code execution, allows attackers to run unauthorized commands within the target process. This can lead to the disclosure of sensitive information or malicious write actions. Affected API endpoints include /<site|page|user>/blueprints, /<site|page>/children, /<model>/files, /languages, /roles, /translations, /users, and /<user>/roles, as well as endpoints allowing search, not, filter, and sort queries. Examples of exploitable methods include password() for disclosing password hashes, root() for revealing absolute filesystem paths, loginPasswordless() for privilege escalation, and delete() for mass deletion of models.

Recommendations Update Kirby to version 4.9.1 or later. Update Kirby to version 5.4.1 or later.