CyberRota Analysis
AI-GeneratedThe vulnerability in the Kirby content management system allows unauthenticated API users to access unsanitized PHP error messages, potentially revealing the full filesystem path of the installation. This could lead to further exploitation or information disclosure if attackers leverage the exposed path. All users of affected versions prior to 4.9.5 and between 5.0.0 and 5.5.1 should prioritize upgrading to the latest versions or disabling the REST API to mitigate this risk.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
Kirby is an open-source content management system. Prior to 4.9.5 and from 5.0.0 through 5.5.1, the REST API error handler can return unsanitized PHP error messages that expose the full filesystem path of the Kirby installation to unauthenticated API users. This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option. This issue is fixed in versions 4.9.5 and 5.5.2.