How severe is CVE-2026-69127?

No CVSS score has been assigned to CVE-2026-69127 yet. Review the advisory details and affected package list to assess your exposure.

Which packages are affected by CVE-2026-69127?

CVE-2026-69127 affects the following packages: getkirby/cms (Packagist), getkirby/cms (Packagist). Ecosystems affected: Packagist.

How do I fix CVE-2026-69127?

Update getkirby/cms to 4.9.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-69127 is resolved across your whole dependency graph.

How do I detect CVE-2026-69127 in my Packagist dependencies?

Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getkirby/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.

How do I mitigate CVE-2026-69127 if there is no patch (or I can't update yet)?

Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Is CVE-2026-69127 actively exploited in the wild?

No public exploit code has been indexed for CVE-2026-69127 yet. This does not mean the vulnerability cannot be exploited — absence of public exploits does not imply safety. Apply the recommended fix and use O3 Security to monitor your exposure.

What is the EPSS score for CVE-2026-69127?

CVE-2026-69127 has an EPSS (Exploit Prediction Scoring System) score of 0.5%, placing it in the 42th percentile of all CVEs. EPSS is maintained by FIRST.org and estimates the probability that a vulnerability will be exploited in the wild within the next 30 days. This score indicates relatively lower exploitation probability, though the CVSS severity should still guide your patching priority.

What type of vulnerability is CVE-2026-69127?

CVE-2026-69127 is classified as CWE-497 (CWE-497). This weakness type describe the underlying flaw category, which helps determine the potential impact and the right class of mitigation.

When was CVE-2026-69127 published, and has it been updated?

CVE-2026-69127 was published on August 7, 2026 and was last updated on September 18, 2026. Advisory data evolves as severity scores, affected ranges, and exploit intelligence are revised — always check the latest version of the advisory before acting.

🐘 Packagist

Not in CISA KEV

CVE-2026-69127 — cms

Fix: getkirby/kirby@469c5a1

CVE-2026-69127 is a CWE-497 vulnerability in getkirby/cms. A fix is available for getkirby/cms — see the affected versions and patch details below.

Kirby: System path exposure from error messages in the REST API

Also known asGHSA-rf2p-vh74-7vvh

Published

Aug 7, 2026

Updated

Sep 18, 2026

Affected

2 pkgs

Patched

2 / 2

Exploits

None indexed

Exploitation data as of Oct 17, 2026 · OSV.dev, NVD, FIRST.org (EPSS)

Exploitation Status

No confirmed exploitation observed yet

CISA assesses this as automatable — exploitation doesn’t require manual, per-target effort, which raises the odds of mass scanning and opportunistic attacks.
CISA’s own triage has not observed active exploitation or public proof-of-concept code for this CVE as of its last assessment.

Exploitation and automatability from CISA’s SSVC triage for CVE-2026-69127.

EPSS Exploitation Probability

via FIRST.org ↗

0.5%probability of exploitation in next 30 days

Lower Risk0.00%

Lower risk than most CVEs42th percentile — riskier than 42% of all scored CVEsHighest risk

Probability of exploitation in the next 30 days, from FIRST.org EPSS.

Real-World Exposure

2 pkgs affected

🐘getkirby/cms🐘getkirby/cms

Real-time download stats are indexed for npm and PyPI packages. This vulnerability affects Packagist packages — download data is not available via public APIs for these ecosystems.

Description

TL;DR

This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option.

It was possible to trigger a PHP error in the API backend that would expose the full filesystem path of the Kirby installation on the server. This could be used to guess the default content.salt or prepare specialized attacks.

Introduction

An information exposure occurs when system data or debugging information leaves the program through an output stream or logging function that makes it accessible to unauthorized parties. Using other weaknesses, an attacker could cause errors to occur; the response to these errors can reveal detailed system information, along with other impacts. An attacker can use messages that reveal technologies, operating systems, and product versions to tune the attack against known vulnerabilities in these technologies. A product may use diagnostic methods that provide significant implementation details such as stack traces as part of its error handling mechanism.

Affected components

Kirby's REST API at /api returns JSON data for each request. If an error occurs during processing of the request, a special error handler converts this error to JSON data that API frontends can handle.

The returned data for errors depends on the debugging mode. If the debug option is enabled, the JSON data contains fields for the path and line of the affected file, the internal exception class and the API route that caused the error. This data is omitted from error responses in production (when the debug option is disabled).

Impact

Some internal errors may contain sensitive information in the error message itself. This is often the case with PHP errors.

In affected releases, the REST API error handler did not sanitize error messages for sensitive information.

This exposed system information like the full source path to external API users, including users without authentication. This could be used to guess the default content.salt or prepare specialized attacks.

Patches

The problem has been patched in Kirby 4.9.5 and Kirby 5.5.2. Please update to one of these or a later version to fix the vulnerability.

In all of the mentioned releases, Kirby has hardened the API error handler to only expose full error messages for exceptions in the Kirby\Exception namespace. All other errors are only exposed in debug mode (with disguised paths, keeping only the paths relative to the Kirby installation). Outside of debug mode, general exceptions and PHP errors are replaced with a generic error message.

Credits

Thanks to Peter Levashov (@petersevera) for responsibly reporting the identified issue.

Affected Packages

2 total 2 fixed

Ecosystem	Package	Vulnerable range	Fix
🐘Packagist	`getkirby/cms`	all versions	4.9.5`composer require getkirby/cms:^4.9.5`
🐘Packagist	`getkirby/cms`	≥ 5.0.0&&< 5.5.2	5.5.2`composer require getkirby/cms:^5.5.2`

Detection & mitigation playbook

Open-source dependency

Detect
Scan your dependency tree (package-lock.json, pnpm-lock.yaml, requirements.txt, go.sum, etc.) for getkirby/cms, including transitive dependencies — a direct dependency you never call can still pull in a vulnerable version.
Fix
Update getkirby/cms to 4.9.5 or later, then make sure no transitive (indirect) dependency still pins the vulnerable range — O3 confirms CVE-2026-69127 is resolved across your whole dependency graph.
Workarounds
Assume what was exposed is already known: rotate any credential, token or key that the affected component could return, restrict the endpoint to callers that genuinely need it, and strip sensitive fields from responses and error output at the boundary rather than relying on the client not to read them.

Frequently Asked Questions

### TL;DR This vulnerability affects all Kirby sites that have not disabled the REST API with the `'api' => false` option. It was possible to trigger a PHP error in the API backend that would expose the full filesystem path of the Kirby installation on the server. This could be used to guess the default `content.salt` or prepare specialized attacks. ---- ### Introduction An information exposure occurs when system data or debugging information leaves the program through an output stream or logging function that makes it accessible to unauthorized parties. Using other weaknesses, an attacke

O3 Security · Impact-Aware SCA

Is CVE-2026-69127 in your dependencies?

Find it across Packagist, including transitive dependencies.

Scan my dependencies How O3 SCA works