CVE-2026-50188

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.4 Kirby versions prior to 5.4.4

Description Kirby sites and plugins using the KirbyHttpRemote class, including the functions Remote::request(), Remote::get(), and Remote::post(), are susceptible to HTTP header injection (also known as CRLF injection). This occurs when untrusted, user-controlled data is passed into the headers option of an outgoing HTTP request without proper sanitization. An attacker can include carriage-return and line-feed characters (r ) in a header value to terminate the intended header and inject separate, unintended request headers. This can be used to override security-relevant headers such as Authorization, Host, or Cookie, potentially leading to request smuggling or cache poisoning on the remote service that Kirby connects to. In a default configuration, the Remote class is not exposed to untrusted input, meaning the issue primarily affects custom code, plugins, or integrations that build request headers from user input.

Recommendations Update Kirby to version 4.9.4 or later. Update Kirby to version 5.4.4 or later. As a temporary mitigation, restrict the use of the headers option in the KirbyHttpRemote class to ensure no untrusted user input is passed to it.