The vulnerability arises from Kirby's REST API not validating model attributes used in collection queries. Attackers can inject arbitrary method names such as password(), root(), loginPasswordless(), or delete() into queries. By doing so, the CMS can retrieve sensitive data—like password hashes and filesystem paths—or execute actions that grant privilege escalation or delete content in bulk when the attacker has appropriate permissions. This is a CWE‑470 weakness that allows unrestricted method calls. The flaw existed in all releases before 4.9.1 and 5.4.1 and has been fixed in those versions.

getkirby:kirby versions prior to 4.9.1 and 5.4.1 are impacted, so any PHP code using earlier releases is vulnerable.

The vulnerability carries a CVSS score of 8.7, indicating high severity. The EPSS score is below 1 %, so the chance of widespread exploitation remains low at present. It is not listed in the CISA KEV catalog. Attackers can exploit it through the publicly accessible search or collection query REST API endpoints; unauthenticated users can obtain sensitive data, while authenticated users with suitable permissions can delete content or gain elevated rights. Given the high impact and the low current exploitation likelihood, administrators should prioritize patching to eliminate future risk.