CVE-2026-44174— Kirby: Arbitrary Method Call via REST API search and collection query endpoints
Possible ATT&CK Techniques 3AI
T1552 · Unsecured Credentials T1059 · Command and Scripting Interpreter T1068 · Exploitation for Privilege EscalationGet alerts for future matching vulnerabilitiesLog in to subscribe
I. Basic Information for CVE-2026-44174
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗ Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
Kirby: Arbitrary Method Call via REST API search and collection query endpoints
Source: NVD (National Vulnerability Database)
Vulnerability Description
Kirby is an open-source content management system. Prior to 4.9.1 and 5.4.1, Kirby did not validate the model attributes that were used in its collection queries, allowing attackers to include arbitrary model methods in their queries. This includes methods with sensitive data such as password() (disclosing the password hash) or root() (disclosing the absolute filesystem path on the server) as well as methods that perform impactful actions such as loginPasswordless() (causing a privilege escalation to another user) or delete() (deleting all queried models in one go if the authenticated user has appropriate permissions). This issue has been fixed in versions 4.9.1 and 5.4.1.
Source: NVD (National Vulnerability Database)
CVSS Information
N/A
Source: NVD (National Vulnerability Database)
Vulnerability Type
使用外部可控制的输入来选择类或代码(不安全的反射)
Source: NVD (National Vulnerability Database)
Affected Products
II. Public POCs for CVE-2026-44174
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POCPremium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-44174
请登录查看更多情报信息。
Vendor Advisories for CVE-2026-44174 (1)
Vendor Pages for CVE-2026-44174 (2)
- 🔗 Release 4.9.1 · getkirby/kirby · GitHubx_refsource_MISC
Same Patch Batch · getkirby · 2026-07-16 · 6 CVEs total
| CVE-2026-44175 | Kirby: Cross-site scripting (XSS) from list field content in the site frontend | |
| CVE-2026-44177 | Kirby: Pre-authentication path traversal and PHP file inclusion during user lookup | |
| CVE-2026-44176 | Kirby: `pages.access` permission is not checked during rendering of page drafts | |
| CVE-2026-45368 | Kirby: Cross-site scripting (XSS) from links in KirbyTags and image blocks in the site fro | |
| CVE-2026-45334 | Kirby: Content locks disclose IDs and emails of inaccessible users from `users.access/list |
IV. Related Vulnerabilities
Same product: kirby
- CVE-2026-45368
Kirby: Cross-site scripting (XSS) from links in KirbyTags an - CVE-2026-45334
Kirby: Content locks disclose IDs and emails of inaccessible - CVE-2026-44175
Kirby: Cross-site scripting (XSS) from list field content in - CVE-2026-44176
Kirby: `pages.access` permission is not checked during rende - CVE-2026-44177
Kirby: Pre-authentication path traversal and PHP file inclus
Same vendor: getkirby
- CVE-2026-45368
Kirby: Cross-site scripting (XSS) from links in KirbyTags an - CVE-2026-45334
Kirby: Content locks disclose IDs and emails of inaccessible - CVE-2026-44175
Kirby: Cross-site scripting (XSS) from list field content in - CVE-2026-44176
Kirby: `pages.access` permission is not checked during rende - CVE-2026-44177
Kirby: Pre-authentication path traversal and PHP file inclus
Same weakness: CWE-470
- CVE-2026-58659
PyTorch Lightning Arbitrary Code Execution via _instantiator - CVE-2026-44795
Spinnaker: Non-safe yaml deserialization allowing RCE when u - CVE-2026-40008
Apache IoTDB: Arbitrary Class Instantiation via Pipe Transfe - CVE-2026-24246
NVIDIA Megatron Bridge 代码注入漏洞 - CVE-2026-13772
IBM WebSphere eXtreme Scale's OQL is affected by remote code
V. Comments for CVE-2026-44174
No comments yet