CVE-2026-69127

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-69127", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "state": "PUBLISHED", "assignerShortName": "GitHub_M", "dateReserved": "2026-08-03T15:20:30.217Z", "datePublished": "2026-08-07T18:33:19.614Z", "dateUpdated": "2026-08-11T22:11:56.971Z"}, "containers": {"cna": {"title": "Kirby: System path exposure from error messages in the REST API", "problemTypes": [{"descriptions": [{"cweId": "CWE-497", "lang": "en", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere", "type": "CWE"}]}], "metrics": [{"cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "baseScore": 6.9, "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "version": "4.0"}}], "references": [{"name": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh", "tags": ["x_refsource_CONFIRM"], "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh"}, {"name": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0"}, {"name": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451", "tags": ["x_refsource_MISC"], "url": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451"}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"version": "< 4.9.5", "status": "affected"}, {"version": ">= 5.0.0, < 5.5.2", "status": "affected"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T22:11:56.971Z"}, "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2."}], "source": {"advisory": "GHSA-rf2p-vh74-7vvh", "discovery": "UNKNOWN"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-08-07T18:56:17.664088Z", "id": "CVE-2026-69127", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T18:56:25.591Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-69127", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-08-07T18:56:17.664088Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-08-07T18:56:21.993Z"}}], "cna": {"title": "Kirby: System path exposure from error messages in the REST API", "source": {"advisory": "GHSA-rf2p-vh74-7vvh", "discovery": "UNKNOWN"}, "metrics": [{"cvssV4_0": {"version": "4.0", "baseScore": 6.9, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW"}}], "affected": [{"vendor": "getkirby", "product": "kirby", "versions": [{"status": "affected", "version": "< 4.9.5"}, {"status": "affected", "version": ">= 5.0.0, < 5.5.2"}]}], "references": [{"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh", "name": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh", "tags": ["x_refsource_CONFIRM"]}, {"url": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0", "name": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0", "tags": ["x_refsource_MISC"]}, {"url": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451", "name": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-497", "description": "CWE-497: Exposure of Sensitive System Information to an Unauthorized Control Sphere"}]}], "providerMetadata": {"orgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "shortName": "GitHub_M", "dateUpdated": "2026-08-11T22:11:56.971Z"}}}, "cveMetadata": {"cveId": "CVE-2026-69127", "state": "PUBLISHED", "dateUpdated": "2026-08-11T22:11:56.971Z", "dateReserved": "2026-08-03T15:20:30.217Z", "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa", "datePublished": "2026-08-07T18:33:19.614Z", "assignerShortName": "GitHub_M"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"product": "kirby", "vendor": "getkirby", "versions": [{"status": "affected", "version": "< 4.9.5"}, {"status": "affected", "version": ">= 5.0.0, < 5.5.2"}]}], "source": "security-advisories@github.com"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2."}, {"lang": "es", "value": "Kirby es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. Antes de la 4.9.5 y desde la 5.0.0 hasta la 5.5.1, el gestor de errores de la API REST puede devolver mensajes de error PHP sin sanear que exponen la ruta completa del sistema de archivos de la instalaci\u00f3n de Kirby a usuarios de la API no autenticados. Esta vulnerabilidad afecta a todos los sitios de Kirby que no han deshabilitado la API REST con la opci\u00f3n \u2019api\u2019 =mayor que false. Este problema est\u00e1 solucionado en las versiones 4.9.5 y 5.5.2."}], "id": "CVE-2026-69127", "lastModified": "2026-10-24T16:10:00.153", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "vulnIntegrityImpact": "NONE", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "security-advisories@github.com", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-69127", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-08-07T18:56:17.664088Z", "version": "2.0.3"}}]}, "published": "2026-08-07T19:18:53.107", "references": [{"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451"}, {"source": "security-advisories@github.com", "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh"}], "sourceIdentifier": "security-advisories@github.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-497"}], "source": "security-advisories@github.com", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[0,4.9.5)"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[5.0.0,5.5.2)"}}], "enrichment": {"confidence": 100.0, "confidence_source": "matching", "scores": [{"score": 100.0, "source": "matching"}]}, "original": {"product": "kirby", "source": "cna", "vendor": "getkirby"}, "product": "kirby", "vendor": "getkirby"}], "created": "2026-08-07T20:45:03.242691+00:00", "updated": "2026-08-07T21:15:03.701612+00:00", "vendors": ["getkirby", "getkirby$PRODUCT$kirby"]}