Kirby CMS Vulnerability Advisory: SSTI, Privilege Escalation, XML Injection (CVE-2026-34587)

Vulnerability Overview 1. Server-Side Template Injection (SSTI) via Double Template Parsing in Option Rendering - Description: This vulnerability affects Kirby sites that use option fields (such as checkboxes, colors, multi-selects, radio buttons, tags, or toggles), where the values of these options may come from queries or APIs and are not fully trusted. - Impact: An attacker can execute arbitrary code by crafting malicious input. - Severity: High (CVSS Score 7.6) - CVE ID: CVE-2026-34587 - Recommendation: GHSa-3jcw-58rv-c452 2. Page, File, and User Creation API Bypasses Create Permission Checks via Unfiltered Blueprint Parameters - Description: This vulnerability affects Kirby sites where users with certain roles do not have permission to create pages, files, or users. - Impact: An attacker can create pages, files, or users by crafting malicious requests. - Severity: High (CVSS Score 7.1) - CVE ID: CVE-2026-41325 - Recommendation: GHSa-6gqr-mx34-wh8r 3. Inconsistent Access/List Permission Checks for Pages and Files in Panel and REST API - Description: This vulnerability affects Kirby sites where users with certain roles do not have permission to access or list pages or files. - Impact: An attacker can access or list pages or files by crafting malicious requests. - Severity: High (CVSS Score 7.1) - CVE ID: To be assigned - Recommendation: GHSa-85x2-r8xv-ww8c 4. Read Access to Site, User, and Role Information Not Gated by Permissions - Description: This vulnerability affects all Kirby sites, where potential attackers can access site models and all users and roles, including content stored within these models. - Impact: An attacker can access sensitive information by crafting malicious requests. - Severity: High (CVSS Score 7.1) - CVE ID: To be assigned - Recommendation: GHSa-2h7v-4372-f6x2 5. XML Injection in XML Creation Toolkit - Description: This vulnerability only affects sites or plugin code that use the data processor methods (e.g., or , , or ). - Impact: An attacker can perform XML injection by crafting malicious input. - Severity: Medium (CVSS Score 6.9) - CVE ID: CVE-2026-32870 - Recommendation: GHSa-9xfj-c55w-93gr 6. User Avatar Creation, Replacement, and Deletion Not Gated by User Update Permission - Description: This vulnerability affects Kirby sites where users with certain roles do not have permission to update user information. - Impact: An attacker can create, replace, or delete user avatars by crafting malicious requests. - Severity: Medium (CVSS Score 5.3) - CVE ID: To be assigned - Recommendation: GHSa-36sp-697y-8xy2 7. Page Creation API Bypasses Permission Check via Unfiltered Parameter - Description: This vulnerability affects Kirby sites where users have permission to create pages but not to change page status. - Impact: An attacker can create published pages by crafting malicious requests. - Severity: Medium (CVSS Score 5.3) - CVE ID: CVE-2026-40099 - Recommendation: GHSa-w942-j9r6-hr6r 8. System API Endpoints Leak Installed Version and License Data to Authenticated Users - Description: This vulnerability affects all Kirby sites, where potential attackers can access installed version and license data. - Impact: An attacker can obtain sensitive information by crafting malicious requests. - Severity: Medium (CVSS Score 5.3) - CVE ID: To be assigned - Recommendation: GHSa-x68m-c7fd-2572 Impact Scope SSTI Vulnerability: Affects Kirby sites that use option fields. Create API Bypass Vulnerability: Affects Kirby sites where users with certain roles do not have permission to create pages, files, or users. Access/List Permission Inconsistency Vulnerability: Affects Kirby sites where users with certain roles do not have permission to access or list pages or files. Unrestricted Read Access Vulnerability: Affects all Kirby sites. XML Injection Vulnerability: Affects sites or plugin code that use data processor methods. User Avatar Permission Not Gated Vulnerability: Affects Kirby sites where users with certain roles do not have permission to update user information. Page Creation API Bypass Vulnerability: Affects Kirby sites where users have permission to create pages but not to change page status. System API Endpoint Disclosure Vulnerability: Affects all Kirby sites. Remediation Measures SSTI Vulnerability: Ensure option field values come from trusted sources; avoid using untrusted query or API values. Create API Bypass Vulnerability: Ensure permission checks are correctly enforced when creating pages, files, or users. Access/List Permission Inconsistency Vulnerability: Consistently enforce access/list permission checks for pages and files in both Panel and REST API. Unrestricted Read Access Vulnerability: Ensure read access to site, user, and role information is gated by permissions. XML Injection Vulnerability: Strictly validate and escape user input to prevent XML injection. User Avatar Permission Not Gated Vulnerability: Ensure permission checks are correctly enforced when creating, replacin

Goal Reached Thanks to every supporter — we hit 100%!

Kirby CMS Vulnerability Advisory: SSTI, Privilege Escalation, XML Injection (CVE-2026-34587)

More from this source