CVE-2026-69127: Kirby: System path exposure from error messages in the REST API

September 1, 2026

Some internal errors may contain sensitive information in the error message itself. This is often the case with PHP errors.

In affected releases, the REST API error handler did not sanitize error messages for sensitive information.

This exposed system information like the full source path to external API users, including users without authentication. This could be used to guess the default content.salt or prepare specialized attacks.

References

github.com/advisories/GHSA-rf2p-vh74-7vvh
github.com/getkirby/kirby/commit/469c5a1a2973811591d996bc967eead3565df1f0
github.com/getkirby/kirby/commit/58f819988436b31969078bc4655452dd48546451
github.com/getkirby/kirby/security/advisories/GHSA-rf2p-vh74-7vvh
nvd.nist.gov/vuln/detail/CVE-2026-69127

Code Behaviors & Features

Detect and mitigate CVE-2026-69127 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →