CVE-2026-69127: Kirby CMS Information Disclosure Flaw

CVE-2026-69127 Overview

CVE-2026-69127 is an information disclosure vulnerability in Kirby, an open-source content management system (CMS). The REST API error handler returns unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. The flaw is categorized as [CWE-497]: Exposure of Sensitive System Information to an Unauthorized Control Sphere.

All Kirby installations that have not disabled the REST API via the 'api' => false option are affected. The issue exists in versions prior to 4.9.5 and in versions 5.0.0 through 5.5.1. Fixed releases are 4.9.5 and 5.5.2.

Critical Impact
Unauthenticated remote attackers can trigger PHP errors through the REST API and receive responses containing absolute filesystem paths, aiding reconnaissance for follow-on attacks.

Affected Products

Kirby CMS versions prior to 4.9.5
Kirby CMS versions 5.0.0 through 5.5.1
Any Kirby site with the REST API enabled (default configuration)

Discovery Timeline

2026-08-07 - CVE-2026-69127 published to NVD
2026-08-11 - Last updated in NVD database

Technical Details for CVE-2026-69127

Vulnerability Analysis

The vulnerability resides in Kirby's REST API error handling logic in src/Api/Api.php. When any non-Kirby exception (such as a raw PHP error) propagates through the API request lifecycle, the handler serializes the exception message directly into the JSON response returned to the client. Because PHP error messages frequently embed absolute filesystem paths, attackers receive information about the installation root, the web server user context, and the directory layout.

The issue reaches unauthenticated users because the REST API is enabled by default and error responses are produced before any authorization step. An attacker only needs to send crafted API requests that trigger PHP-level errors to harvest path data.

Root Cause

The pre-patch code path assigned $e->getMessage() directly into the API result array without distinguishing between intentional Kirby exceptions (which carry safe, curated messages) and generic PHP exceptions (which may leak internal details). No sanitization or path-masking was applied before the message was serialized.

Attack Vector

An unauthenticated attacker sends HTTP requests to Kirby REST API endpoints that induce PHP errors, such as malformed parameters or requests targeting internal helper routines. The server returns a JSON error object whose message field contains the raw PHP error string, including absolute file paths under the Kirby, site, or index roots.

php

			$docRoot = $_SERVER['DOCUMENT_ROOT'] ?? null;
		}

		// determine which message to expose to avoid leaking
		// internal details (e.g. file paths) from PHP errors
		if ($e instanceof ExceptionException) {
			// Kirby exceptions carry safe, intentional messages
			// that can be returned as-is whether debugging or not
			$message = $e->getMessage();

		} elseif ($this->debug === true) {
			// in debug mode, expose the actual message
			// but disguise absolute file paths in it
			$message = $e->getMessage();

			if (isset($this->kirby) === true) {
				$message = $this->kirby->disguiseFilePath($message);
			}

		} else {
			// any other (PHP) error could leak internal details,
			// so only a generic message is returned
			$message = I18n::translate('error.unexpected');
		}

		// prepare the result array for all exception types
		$result = [
			'status'    => 'error',
			'message'   => $message,

Source: Kirby commit 469c5a1

The patch introduces a three-branch decision. Kirby-typed exceptions pass through, debug-mode responses have paths masked via disguiseFilePath(), and all other errors are replaced with a generic translated message.

Detection Methods for CVE-2026-69127

Indicators of Compromise

API JSON responses under /api/ endpoints where the message field contains absolute filesystem paths such as /var/www/, /home/, or Windows drive letters
Unusual bursts of REST API requests from a single source generating HTTP 4xx or 5xx responses
Requests targeting Kirby API endpoints with malformed parameters or unexpected content types intended to trigger PHP errors

Detection Strategies

Inspect outbound API responses in a web proxy or WAF for path-like patterns inside JSON message fields
Correlate error-rate spikes on Kirby endpoints with client IPs to identify reconnaissance scanning
Review web server error logs for PHP notices and warnings originating from src/Api/Api.php on the affected versions

Monitoring Recommendations

Alert on HTTP responses from Kirby hosts containing regex matches for absolute paths in JSON payloads
Track version strings served by Kirby installations and flag any host running versions prior to 4.9.5 or between 5.0.0 and 5.5.1
Monitor authentication logs following any information-disclosure indicator, as leaked paths often precede targeted exploitation attempts

How to Mitigate CVE-2026-69127

Immediate Actions Required

Upgrade Kirby to version 4.9.5 or 5.5.2, which contain the sanitization fix
If upgrading is not immediately possible, disable the REST API by setting 'api' => false in the site configuration
Disable debug mode in production by ensuring debug is set to false in config.php

Patch Information

The vendor released fixes in Kirby 4.9.5 and 5.5.2. The remediation is documented in the Kirby Security Advisory GHSA-rf2p-vh74-7vvh. The patch adds a disguiseFilePath() helper in src/Cms/AppErrors.php that replaces absolute paths with {kirby}, {site}, and {index} placeholders, and restricts raw PHP error messages to a generic translated string outside of debug mode.

php

	/**
	 * Replaces absolute file paths with placeholders such as
	 * {kirby}, {site} or {index} to avoid exposing too many
	 * details about the filesystem and keeping error responses
	 * short and readable in debug mode.
	 *
	 * @since 4.9.5
	 * @internal
	 */
	public function disguiseFilePath(string $file): string
	{
		$disguise = [
			$this->root('kirby') => '{kirby}',
			$this->root('site')  => '{site}',
			$this->root('index') => '{index}'
		];

		return str_replace(array_keys($disguise), array_values($disguise), $file);
	}