Kirby is an open‑source content management system that, before version 4.9.5 and between 5.0.0 and 5.5.1, returned unsanitized PHP error messages from its REST API to any unauthenticated user. The error handler could reveal the complete file system path of the Kirby installation, exposing sensitive setup information. This flaw is a classic case of CWE‑497, where unvalidated input is echoed in an error response. An attacker who can trigger an error via the REST endpoint learns the precise location of the application on the host, which can be leveraged for subsequent exploits such as path traversal or file inclusion. The primary impact is disclosure of internal paths, potentially aiding further attacks but not directly permitting code execution or privilege escalation.

All installations of Kirby CMS dated prior to 4.9.5 or between 5.0.0 and 5.5.1 that have the REST API enabled (the default configuration has "api" enabled). Sites using the official "getkirby:kirby" package and not disabling the API are vulnerable.

The CVSS score of 6.9 indicates a moderate risk. EPSS information is not available, and the vulnerability is not listed in CISA KEV, implying no publicly known exploits at this time. The attack vector is unauthenticated access through the publicly exposed REST API; any user can trigger the error handler by sending malformed requests. While the exposed path does not allow direct code execution, it provides convenient reconnaissance data for attackers to craft more targeted attacks. Overall, the threat is significant enough to warrant prompt remediation.