CVE-2026-54004

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents. This issue is fixed in versions 4.9.4 and 5.4.4.

CVSS

No CVSS.

References

Link	Resource
https://github.com/getkirby/kirby/commit/5b9a0ed587575e39156d37fa42ca7f6c73e121f7
https://github.com/getkirby/kirby/commit/bc721080cd8dd4dcb7fc20b3fd0460ee8d0603b0
https://github.com/getkirby/kirby/releases/tag/4.9.4
https://github.com/getkirby/kirby/releases/tag/5.4.4
https://github.com/getkirby/kirby/security/advisories/GHSA-89cp-7p28-jffg

Configurations

No configuration.

History

25 Oct 2026, 17:10

Type	Values Removed	Values Added
Summary		(es) Kirby es un sistema de gestión de contenido de código abierto. Anteriormente a las versiones 4.9.4 y 5.4.4, los sitios de Kirby con content.fileRedirects habilitado podían redirigir solicitudes de URL de archivos limpios no autenticadas para archivos almacenados en páginas de borrador de nivel superior a URL de medios físicos sin verificar los permisos de acceso a la página o los tokens de vista previa, lo que llevaba a la divulgación del contenido de los archivos de borrador. Este problema se ha corregido en las versiones 4.9.4 y 5.4.4.

Information

Published : 2026-07-09 19:17

Updated : 2026-10-25 17:10

NVD link : CVE-2026-54004

Mitre link : CVE-2026-54004

CVE.ORG link : CVE-2026-54004

JSON object : View

Products Affected

No product.

CWE

CWE-862

Missing Authorization

{"id": "CVE-2026-54004", "cveTags": [], "metrics": {"ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-54004", "role": "CISA Coordinator", "options": [{"exploitation": "none"}, {"automatable": "no"}, {"technicalImpact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-09T19:47:55.357107Z"}}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 6.3, "Automatable": "NOT_DEFINED", "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "NONE", "vulnConfidentialityImpact": "LOW", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "affected": [{"source": "security-advisories@github.com", "affectedData": [{"vendor": "getkirby", "product": "kirby", "versions": [{"status": "affected", "version": "< 4.9.4"}, {"status": "affected", "version": ">= 5.0.0, < 5.4.4"}]}]}], "published": "2026-07-09T19:17:06.270", "references": [{"url": "https://github.com/getkirby/kirby/commit/5b9a0ed587575e39156d37fa42ca7f6c73e121f7", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/commit/bc721080cd8dd4dcb7fc20b3fd0460ee8d0603b0", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.9.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/releases/tag/5.4.4", "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-89cp-7p28-jffg", "source": "security-advisories@github.com"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Secondary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-862"}]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents. This issue is fixed in versions 4.9.4 and 5.4.4."}, {"lang": "es", "value": "Kirby es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. Anteriormente a las versiones 4.9.4 y 5.4.4, los sitios de Kirby con content.fileRedirects habilitado pod\u00edan redirigir solicitudes de URL de archivos limpios no autenticadas para archivos almacenados en p\u00e1ginas de borrador de nivel superior a URL de medios f\u00edsicos sin verificar los permisos de acceso a la p\u00e1gina o los tokens de vista previa, lo que llevaba a la divulgaci\u00f3n del contenido de los archivos de borrador. Este problema se ha corregido en las versiones 4.9.4 y 5.4.4."}], "lastModified": "2026-10-25T17:10:00.197", "sourceIdentifier": "security-advisories@github.com"}