CVE-2026-50188

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::request(), Remote::get(), and Remote::post(), to send outgoing HTTP requests with untrusted data in the headers option could allow newline characters in a header value to inject a separate unintended request header to the remote service. This issue is fixed in versions 4.9.4 and 5.4.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/getkirby/kirby/commit/aa33414e1669e866cdd6f4decfae2a669e8bb828
https://github.com/getkirby/kirby/commit/fad9cbd22c73ed0fbd3aaf62310a8dcacfc007cd
https://github.com/getkirby/kirby/releases/tag/4.9.4
https://github.com/getkirby/kirby/releases/tag/5.4.4
https://github.com/getkirby/kirby/security/advisories/GHSA-4v4h-m2qq-ppgw

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Kirby es un sistema de gestión de contenidos de código abierto. Antes de las versiones 4.9.4 y 5.4.4, los sitios y plugins de Kirby que utilizaban la clase Kirby Http Remote, incluyendo Remote::request(), Remote::get() y Remote::post(), para enviar solicitudes HTTP salientes con datos no confiables en la opción de encabezados, podrían permitir que los caracteres de nueva línea en un valor de encabezado inyectaran un encabezado de solicitud separado e involuntario al servicio remoto. Este problema está solucionado en las versiones 4.9.4 y 5.4.4.

Information

Published : 2026-07-09 19:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-50188

Mitre link : CVE-2026-50188

CVE.ORG link : CVE-2026-50188

JSON object : View

Products Affected

No product.

CWE

CWE-93

Improper Neutralization of CRLF Sequences ('CRLF Injection')

CWE-113

Improper Neutralization of CRLF Sequences in HTTP Headers ('HTTP Request/Response Splitting')

{"id": "CVE-2026-50188", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-50188", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T19:18:33.304762Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.9, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:H/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "HIGH", "attackRequirements": "NONE", "privilegesRequired": "NONE", "subIntegrityImpact": "HIGH", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getkirby", "product": "kirby", "versions": [{"status": "affected", "version": "< 4.9.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.4"}]}]}], "published": "2026-07-09T19:17:05.827", "references": [{"url": "https://github.com/getkirby/kirby/commit/aa33414e1669e866cdd6f4decfae2a669e8bb828", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/commit/fad9cbd22c73ed0fbd3aaf62310a8dcacfc007cd", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.9.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/releases/tag/5.4.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-4v4h-m2qq-ppgw", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-93"}, {"lang": "en", "value": "CWE-113"}]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites and plugins using the Kirby Http Remote class, including Remote::request(), Remote::get(), and Remote::post(), to send outgoing HTTP requests with untrusted data in the headers option could allow newline characters in a header value to inject a separate unintended request header to the remote service. This issue is fixed in versions 4.9.4 and 5.4.4."}, {"lang": "es", "value": "Kirby es un sistema de gesti\u00f3n de contenidos de c\u00f3digo abierto. Antes de las versiones 4.9.4 y 5.4.4, los sitios y plugins de Kirby que utilizaban la clase Kirby Http Remote, incluyendo Remote::request(), Remote::get() y Remote::post(), para enviar solicitudes HTTP salientes con datos no confiables en la opci\u00f3n de encabezados, podr\u00edan permitir que los caracteres de nueva l\u00ednea en un valor de encabezado inyectaran un encabezado de solicitud separado e involuntario al servicio remoto. Este problema est\u00e1 solucionado en las versiones 4.9.4 y 5.4.4."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security-advisories@github.com"}