CVE-2026-44177: kirby >= 5.3.0, < 5.4.1

Affected technology

kirby · >= 5.3.0, < 5.4.1
getkirby

Component: Not specified by the source

Attack conditions (Vendor/CNA, CVSS 4.0): Network (remote) · No privileges required · No user interaction required

What an attacker can do

An attacker could trigger arbitrary PHP file inclusion of files named index.php (for example, the main PHP files of plugins), the impact of which depends on the logic those files contain. Vendor/CNA’s CVSS 4.0 assessment (base score 8.8/10) rates confidentiality impact as high; integrity impact as low; availability impact as none.