CVE-2026-54004

Description

Kirby is an open-source content management system. Prior to 4.9.4 and 5.4.4, Kirby sites with content.fileRedirects enabled could redirect unauthenticated clean file URL requests for files stored in top-level draft pages to physical media URLs without checking page access permissions or preview tokens, leading to disclosure of draft file contents. This issue is fixed in versions 4.9.4 and 5.4.4.

PUBLISHED Reserved 2026-06-11 | Published 2026-07-09 | Updated 2026-07-09 | Assigner GitHub_M

Problem types

CWE-862: Missing Authorization

Product status

References

github.com/.../kirby/security/advisories/GHSA-89cp-7p28-jffg

github.com/...ommit/5b9a0ed587575e39156d37fa42ca7f6c73e121f7

github.com/...ommit/bc721080cd8dd4dcb7fc20b3fd0460ee8d0603b0

github.com/getkirby/kirby/releases/tag/4.9.4

github.com/getkirby/kirby/releases/tag/5.4.4

cve.org (CVE-2026-54004)

nvd.nist.gov (CVE-2026-54004)

Download JSON