CVE-2026-54004mediumCWE-862

Kirby: Access to files of top-level drafts is not protected by permissions

13Vexday Risk Score

Sin señal de explotación. Ningún artefacto público de explotación conocido hasta ahora.

ssvc Trackcvss 6.3epss 0.3%

probabilidad de explotación

0.3%top 76% de las CVE

explotación observada

noninguna fuente lo reporta

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents. This issue is fixed in versions 4.9.4 and 5.4.4.

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N

Productos afectados

getkirby · kirby

Referencias

https://github.com/getkirby/kirby/commit/5b9a0ed587575e39156d37fa42ca7f6c73e121f7 https://github.com/getkirby/kirby/commit/bc721080cd8dd4dcb7fc20b3fd0460ee8d0603b0 https://github.com/getkirby/kirby/releases/tag/4.9.4 https://github.com/getkirby/kirby/releases/tag/5.4.4 https://github.com/getkirby/kirby/security/advisories/GHSA-89cp-7p28-jffg