Kirby is an open‑source content management system. Prior to Kirby 4.9.4 and before version 5.4.4, sites that have no user accounts and are behind a reverse proxy that forwards the Forwarded, X‑Client‑IP, or X‑Real‑IP headers are vulnerable because the system incorrectly trusts these headers in its local‑IP checks. An attacker can inject such a header into a request, triggering the automatic installation of the Panel and the creation of the first administrative user, thereby gaining full administrative control. The bug has been fixed in versions 4.9.4 and 5.4.4 and is classified as CWE‑454.

The vulnerability affects getkirby:kirby installations running any version before 4.9.4 and any 5.x release before 5.4.4 that have no configured user accounts. Only sites exposed to the public internet behind a reverse proxy that forwards the Forwarded, X‑Client‑IP, or X‑Real‑IP headers are susceptible.

The CVSS score of 9.1 indicates a severe flaw. The EPSS score of less than 1% implies a very low probability of exploitation, and the vulnerability is not listed in CISA KEV. The likely attack vector is a crafted HTTP request to the reverse proxy containing the aforementioned headers, which an attacker controlling or accessing the proxy can easily perform. If unpatched, an attacker can gain full administrative access to the site.