Kirby, an open‑source CMS by getkirby, suffered a flaw that existed in versions 5.3.0 through 5.4.0. The vulnerability stemmed from a lazy loading of user objects that used an unchecked user ID or email supplied in a request to locate the user’s account directory under site/accounts. Because the identifier was not properly validated, an attacker could embed path‑traversal sequences, causing the system to resolve to arbitrary files. By supplying a request that referenced a PHP file such as index.php, the attacker can trigger inclusion of that file. The code that is executed depends on the content of the included file, but this can lead to remote code execution. This path‑traversal and file‑inclusion flaw corresponds to CWE‑22 and CWE‑98. In addition to code inclusion, the flaw allows probing for the existence of arbitrary directories, enabling fingerprinting of the server’s plugin and content layout.

The vulnerability affects the open‑source CMS Kirby by getkirby. Software versions from 5.3.0 up to but excluding 5.4.1 are susceptible.

The high severity is reflected in a CVSS base score of 8.8. The EPSS score is under 1 %, indicating that widespread exploitation is not yet occurring, and the vulnerability does not appear in the CISA KEV list. Attack vectors require only accesses to the user lookup endpoints, which can be reached through the public authentication API or the authenticated user API. The ability to trigger arbitrary PHP inclusion and directory probing can give attackers remote code execution and reconnaissance, making this a potentially high‑impact vulnerability.