CVE-2026-34587

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-34587", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-03-30T16:56:30.999Z", "datePublished": "2026-04-24T00:23:36.931Z", "dateUpdated": "2026-04-24T18:18:17.883Z"}, "containers": {"cna": {"title": "Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering", "problemTypes": [{"descriptions": [{"cweId": "CWE-1336", "lang": "en", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "userInteraction": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 7.6, "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/getkirby/kirby/security/advisories/GHSA-jcjw-58rv-c452", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-jcjw-58rv-c452"}, {"name": "https://github.com/getkirby/kirby/releases/tag/4.9.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/releases/tag/4.9.0"}, {"name": "https://github.com/getkirby/kirby/releases/tag/5.4.0", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/releases/tag/5.4.0"}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"version": "< 4.9.0", "status": "affected"}, {"version": ">= 5.0.0, < 5.4.0", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T00:32:30.782Z"}, "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions. For pages, Kirby provides the `pages.create` and `pages.changeStatus` permissions (among others). In affected releases, Kirby checked these permissions independently and only for the respective action. However the `changeStatus` permission didn't take effect on page creation. New pages are created as drafts by default and need to be published by changing the page status of an existing page draft. This is ensured when the page is created via the Kirby Panel. However the REST API allows to override the `isDraft` flag when creating a new page. This allowed authenticated attackers with the `pages.create` permission to immediately create published pages, bypassing the normal editorial workflow. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. Kirby has updated the `Options` logic to no longer double-resolve queries in option values coming from `OptionsQuery` or `OptionsApi` sources. Kirby now only resolves queries that are directly configured in the blueprints."}], "source": {"advisory": "GHSA-jcjw-58rv-c452", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-04-24T17:10:14.053475Z", "id": "CVE-2026-34587", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T18:18:17.883Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-34587", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2026-04-24T17:10:14.053475Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-04-24T17:10:18.319Z"}}], "cna": {"title": "Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering", "source": {"advisory": "GHSA-jcjw-58rv-c452", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 7.6, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "LOW", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "HIGH", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "HIGH"}}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"status": "affected", "version": "< 4.9.0"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.0"}]}], "references": [{"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-jcjw-58rv-c452", "name": "https://github.com/getkirby/kirby/security/advisories/GHSA-jcjw-58rv-c452", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.9.0", "name": "https://github.com/getkirby/kirby/releases/tag/4.9.0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/releases/tag/5.4.0", "name": "https://github.com/getkirby/kirby/releases/tag/5.4.0", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions. For pages, Kirby provides the `pages.create` and `pages.changeStatus` permissions (among others). In affected releases, Kirby checked these permissions independently and only for the respective action. However the `changeStatus` permission didn't take effect on page creation. New pages are created as drafts by default and need to be published by changing the page status of an existing page draft. This is ensured when the page is created via the Kirby Panel. However the REST API allows to override the `isDraft` flag when creating a new page. This allowed authenticated attackers with the `pages.create` permission to immediately create published pages, bypassing the normal editorial workflow. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. Kirby has updated the `Options` logic to no longer double-resolve queries in option values coming from `OptionsQuery` or `OptionsApi` sources. Kirby now only resolves queries that are directly configured in the blueprints."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-1336", "description": "CWE-1336: Improper Neutralization of Special Elements Used in a Template Engine"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-04-24T00:32:30.782Z"}}}, "cveMetadata": {"cveId": "CVE-2026-34587", "state": "PUBLISHED", "dateUpdated": "2026-04-24T18:18:17.883Z", "dateReserved": "2026-03-30T16:56:30.999Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-04-24T00:23:36.931Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kirby", "vendor": "getkirby", "versions": [{"status": "affected", "version": "< 4.9.0"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.0"}]}], "source": "security-advisories@github.com"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "matchCriteriaId": "1BB5394F-37F9-4A53-9CE7-79548F674886", "versionEndExcluding": "4.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "matchCriteriaId": "B2D943B9-CD71-45FE-A1A4-158603C3502E", "versionEndExcluding": "5.4.0", "versionStartIncluding": "5.0.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (`site/blueprints/users/...`). It is also possible to customize the permissions for each target model in the model blueprints (such as in `site/blueprints/pages/...`) using the `options` feature. The permissions and options together control the authorization of user actions. For pages, Kirby provides the `pages.create` and `pages.changeStatus` permissions (among others). In affected releases, Kirby checked these permissions independently and only for the respective action. However the `changeStatus` permission didn't take effect on page creation. New pages are created as drafts by default and need to be published by changing the page status of an existing page draft. This is ensured when the page is created via the Kirby Panel. However the REST API allows to override the `isDraft` flag when creating a new page. This allowed authenticated attackers with the `pages.create` permission to immediately create published pages, bypassing the normal editorial workflow. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. Kirby has updated the `Options` logic to no longer double-resolve queries in option values coming from `OptionsQuery` or `OptionsApi` sources. Kirby now only resolves queries that are directly configured in the blueprints."}, {"lang": "es", "value": "Kirby es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. Antes de las versiones 4.9.0 y 5.4.0, los permisos de usuario de Kirby controlan qu\u00e9 rol de usuario tiene permitido realizar acciones espec\u00edficas en los modelos de contenido en el CMS. Estos permisos se definen para cada rol en el blueprint de usuario (\u2019site/blueprints/users/...\u2019). Tambi\u00e9n es posible personalizar los permisos para cada modelo objetivo en los blueprints de modelo (como en \u2019site/blueprints/pages/...\u2019) utilizando la caracter\u00edstica \u2019options\u2019. Los permisos y las opciones juntos controlan la autorizaci\u00f3n de las acciones del usuario. Para las p\u00e1ginas, Kirby proporciona los permisos \u2019pages.create\u2019 y \u2019pages.changeStatus\u2019 (entre otros). En las versiones afectadas, Kirby verificaba estos permisos de forma independiente y solo para la acci\u00f3n respectiva. Sin embargo, el permiso \u2019changeStatus\u2019 no ten\u00eda efecto en la creaci\u00f3n de p\u00e1ginas. Las nuevas p\u00e1ginas se crean como borradores por defecto y necesitan ser publicadas cambiando el estado de la p\u00e1gina de un borrador de p\u00e1gina existente. Esto se asegura cuando la p\u00e1gina se crea a trav\u00e9s del Panel de Kirby. Sin embargo, la API REST permite anular el indicador \u2019isDraft\u2019 al crear una nueva p\u00e1gina. Esto permit\u00eda a atacantes autenticados con el permiso \u2019pages.create\u2019 crear inmediatamente p\u00e1ginas publicadas, eludiendo el flujo de trabajo editorial normal. El problema ha sido parcheado en Kirby 4.9.0 y Kirby 5.4.0. Kirby ha actualizado la l\u00f3gica de \u2019Options\u2019 para ya no resolver consultas dos veces en los valores de opci\u00f3n provenientes de fuentes \u2019OptionsQuery\u2019 o \u2019OptionsApi\u2019. Kirby ahora solo resuelve consultas que est\u00e1n directamente configuradas en los blueprints."}], "id": "CVE-2026-34587", "lastModified": "2026-10-26T21:10:00.170", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "LOW", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:N", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.2, "source": "nvd@nist.gov", "type": "Primary"}], "cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 7.6, "baseSeverity": "HIGH", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "LOW", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "HIGH", "vulnIntegrityImpact": "HIGH", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-34587", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2026-04-24T17:10:14.053475Z", "version": "2.0.3"}}]}, "published": "2026-04-24T01:16:12.120", "references": [{"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/getkirby/kirby/releases/tag/4.9.0"}, {"source": "security-advisories@github.com", "tags": ["Release Notes"], "url": "https://github.com/getkirby/kirby/releases/tag/5.4.0"}, {"source": "security-advisories@github.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-jcjw-58rv-c452"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-1336"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.0)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.4.0)"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "kirby", "source": "cna", "vendor": "getkirby"}, "product": "kirby", "vendor": "getkirby"}], "analysis": {"en": {"generated_at": "2026-04-28T07:05:18.320716+00:00", "value": {"mitigation_remediation": ["Upgrade Kirby CMS to version 4.9.0 or 5.4.0 to fix the permission check logic.", "If an upgrade cannot be performed immediately, disable or restrict the REST API endpoints that allow isDraft flag manipulation, or enforce that only users with changeStatus permission can set this flag.", "Review and tighten user role permissions, ensuring that pages.create is only assigned to trusted users, and that pages.changeStatus is granted only when necessary, following the principle of least privilege."], "summary": {"action": "Patch", "impact": "Privilege Escalation / Authorization Bypass"}, "threat_synthesis": {"affected_systems": "Affected systems are installations of the Kirby content management system version 4.8.x and earlier, and version 5.3.x and earlier, before the release of 4.9.0 and 5.4.0 respectively. The vulnerability is present regardless of the front\u2011end or back\u2011end configuration, as long as the REST API is accessible.", "description_and_impact": "The vulnerability is an authorization flaw where the CMS\u2019s REST API allows any authenticated user with the pages.create permission to set the isDraft flag to false, creating published content without requiring changeStatus permission. This bypasses the intended editorial workflow and enables malicious users to publish or modify content. The flaw stems from how the system resolves permission checks independently, leading to a privilege escalation scenario, classified as CWE-1336.", "risk_and_exploitability": "The CVSS base score is 7.6, indicating moderate to high severity, but the EPSS score of less than 1% suggests an unlikely exploitation rate at present. The vulnerability is not listed in the CISA KEV catalog. Attackers need authenticated access and the ability to send REST API requests, so the attack vector is authenticated. Once authenticated, the attacker can immediately publish new pages, causing potential reputational and compliance damage."}}}}, "created": "2026-04-28T01:30:17.723132+00:00", "updated": "2026-04-28T07:15:19.373139+00:00", "vendors": ["getkirby", "getkirby$PRODUCT$kirby"]}