CVE-2026-44177

Name of the Vulnerable Software and Affected Versions Kirby versions 5.3.0 through 5.4.0

Description Kirby failed to correctly validate the provided user ID, leading to a path traversal issue. This occurs when the system uses the user ID to locate account directories under site/accounts. The issue affects the authentication API, which is accessible to unauthenticated requests, the users API, and any other component utilizing the find() function to look up users by email or ID. This allows an attacker to perform arbitrary PHP file inclusion of files named index.php, such as main plugin files, and probe for the existence of arbitrary directories on the server to fingerprint the site setup, installed plugins, and content structure. Path traversal is a technique using special characters like ../ to access files outside the intended directory, while PHP file inclusion involves loading and executing PHP files not intended for direct inclusion.

Recommendations Update Kirby to version 5.4.1 or later.