Loading story…
Kirby has released security fixes for multiple high-severity vulnerabilities affecting its CMS, including a pre-authentication path traversal and PHP file inclusion bug tracked as CVE-2026-44177. The flaw affects 5.3.0 through 5.4.0 and stems from improper validation of user IDs after lazy loading was introduced for the Users collection, exposing the authentication API, users API, and other code paths using user lookups. Advisories say successful exploitation could allow arbitrary inclusion of PHP files named index.php and enable directory probing for server and site fingerprinting. Kirby also patched CVE-2026-44174, an arbitrary method call issue in REST API search and collection query endpoints that could lead to sensitive information disclosure, privilege escalation, or destructive actions such as deleting queried models when permissions allowed.
The update also closes multiple frontend cross-site scripting vulnerabilities. CVE-2026-44175 allowed persistent XSS because list field content was not sanitized on save, letting malicious HTML be stored through Kirby's API and later executed in visitors' and logged-in users' browsers. CVE-2026-45368 affected KirbyTags, image blocks, and imported HTML because malicious URL schemes such as javascript: and similar variants could bypass filtering and trigger script execution. The issues affect versions earlier than 4.9.1 and 5.0.0 through 5.4.0, and were fixed in 4.9.1 and 5.4.1; the release also included additional hardening, fixes for authorization and information disclosure issues, and an updated symfony/yaml dependency.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
GitHub Security Advisories received CVE-2026-44174 on 2026-07-16. The vulnerability affects Kirby versions earlier than 4.9.1 and 5.0.0 through before 5.4.1, allowing arbitrary model method invocation via REST API search and collection query endpoints.
On 2026-05-19, Kirby published release 5.4.1 to fix multiple security issues, including the pre-authentication path traversal/PHP file inclusion flaw, arbitrary method calls via REST API endpoints, and several frontend XSS vectors. The release also included additional hardening changes and a patched symfony/yaml dependency.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
5 references tracked. Mallory keeps watching after this page renders.
cvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcecvefeed.io
Open sourcegithub.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Two high-severity SQL injection vulnerabilities were disclosed in **Kysely**, the TypeScript SQL query builder, affecting versions `0.28.12` and `0.28.13` in one case and versions prior to `0.28.14` in another. Both flaws stem from improper handling of backslashes in `DefaultQueryCompiler.sanitizeStringLiteral()`, which escaped single quotes but did not escape backslashes. In MySQL deployments using the default backslash-escape behavior, an attacker could place a backslash before a quote, break out of a string literal or JSON path string, and inject arbitrary SQL. Both issues are tracked as **CWE-89** and carry a **CVSS 3.1** score vector of `AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H`. The first issue, **`CVE-2026-33442`**, affects non-type-safe usage of JSON path keys, while **`CVE-2026-33468`** impacts code paths that inline values into compiled SQL strings, including `sql.lit(string)`-style usage and components such as `CreateIndexBuilder.where()` and `CreateViewBuilder.as()` through `ImmediateValueTransformer`. GitHub security advisories were referenced for both disclosures, and the vendor fixed the vulnerabilities in **Kysely `0.28.14`**, making upgrade the primary remediation for affected MySQL-backed applications.
Jun 29, 2026
GitLab disclosed and remediated three high-severity vulnerabilities in GitLab CE/EE that could be exploited by unauthenticated attackers under certain conditions. **CVE-2026-4922** is a cross-site request forgery flaw (`CWE-352`) that could let an attacker trigger GraphQL mutations as an authenticated user, while **CVE-2026-5262** is a cross-site scripting issue (`CWE-79`) that could expose tokens in the Storybook development environment. GitLab also fixed **CVE-2026-5816**, an improper path validation flaw (`CWE-41`) that could allow arbitrary JavaScript execution in a victim’s browser session. The issues affect multiple GitLab CE/EE release lines, with patched versions identified as **18.9.6**, **18.10.4**, and **18.11.1** depending on the flaw. CVE-2026-4922 affects versions from `17.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; CVE-2026-5262 affects versions from `16.1.0` before `18.9.6`, `18.10` before `18.10.4`, and `18.11` before `18.11.1`; and CVE-2026-5816 affects `18.10` before `18.10.4` and `18.11` before `18.11.1`. The vulnerabilities carry CVSS v3.1 ratings reflecting high confidentiality and integrity impact, and GitLab linked the disclosures to its patch release notice, internal work items, and HackerOne reports.
Jun 29, 2026
Craft CMS disclosed six vulnerabilities affecting **4.x** and **5.x** releases, including a **critical** remote code execution flaw tracked as `CVE-2026-72781`. The most severe issue affects versions **5.0.0-RC1 through before 5.10.7** and **4.0.0-RC1 through before 4.18.3**, where an authenticated user with control panel access can render a malicious Twig template and execute arbitrary code even when the Twig sandbox is enabled. The flaw stems from Craft marking `ElementInterface` as safe and extending sandbox allowlisting through the class hierarchy to `yii\base\Component`, creating an arbitrary function-call gadget.
Aug 11, 2026