getkirby/cms

Packagist51 known CVEs affecting this package

Aggregated from OSV, GitHub Security Advisories, NVD, and vendor advisories. Each CVE links to its full detail page with vendor advisories, patches, fixed versions, and remediation guidance.

CVEs affecting getkirby/cmspage 2 of 2

• CVE-2026-75594HIGHCVSS 8.2EG 8.2✓ Fixed in 5.5.2

  2026-08-31

  vulnerable: 5.0.0 ... 5.5.1 (28 versions)

  Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated parent…