Kirby is an open‑source content‑management system. Versions earlier than 4.9.4 and 5.4.4 contain a request‑header injection flaw in the Http Remote class. When Remote::request(), Remote::get() or Remote::post() are used to send outgoing HTTP requests, an untrusted value supplied in the headers option may contain newline characters. These characters create unintended additional request headers on the remote service, allowing an attacker to inject arbitrary headers into outbound requests, which can alter the behavior of third‑party services that the Kirby site communicates with. This vulnerability is a classic request‑header injection weakness and is identified by CWE‑113 and CWE‑93.

The flaw affects the Kirby open‑source content management system, with versions released before 4.9.4 and before 5.4.4. Any Kirby site or plugin that uses Http Remote methods—Remote::request(), Remote::get(), or Remote::post()—and incorporates user‑supplied values into the headers option is vulnerable.

The CVSS score of 6.9 indicates moderate severity, and the vulnerability is not listed in CISA’s KEV catalog. The EPSS score of <1% suggests a very low probability of exploitation in the wild. Exploitation requires an attacker to supply crafted header data to a Kirby application; if the application forwards this data unchanged, the attacker can inject additional headers into outgoing requests to dependent services. Because this activity involves outbound communication, it can be used to influence third‑party services even when the attacker cannot directly access them.