CVE-2026-69127

CVE-2026-69127 is a path disclosure vulnerability in Kirby CMS. The REST API endpoint at /api returns full filesystem paths in error messages when it receives malformed requests—no authentication required. This is not a standalone remote code execution, but it collapses the cost of subsequent attack phases significantly. An attacker gets a clean map of server paths without guessing at absolute paths for local file inclusion targets or brute-forcing directory structures for privilege escalation paths. This is reconnaissance gold for anyone targeting Kirby installations, and it requires zero credentials. The vendor-recommended workaround—setting 'api' => false in the config—disables the vulnerability but also disables the REST API entirely. If you're running Kirby for its headless capabilities, this is a breaking change, not a minor hardening step. The actual fix in versions 4.9.5 and 5.5.2 presumably sanitizes error output rather than removing functionality, which is what should have been done from the start. The EPSS score of 0.00291 means automated exploitation isn't active yet. This creates a narrow window where defenders can close the gap before scanning campaigns mature. But Kirby's user base skews toward designers and smaller agencies—organizations without automated patch management where this advisory may sit unread for weeks while tooling develops. The CVSS 6.9 rating captures the theoretical severity but misses what attackers actually do with path disclosure: they chain it. Every prior instance of medium-rated path disclosure through error handlers has later served as reconnaissance infrastructure for higher-severity chained exploits. The CVSS measures the vulnerability; it doesn't model attacker workflow efficiency gains. What you should do: prioritize this patch if you run Kirby, but understand that the real risk is the compound exposure—path disclosure combined with any other vulnerability in the same system, or with time. The workaround blinds your own monitoring by removing the endpoint from access logs and WAF signatures. Don't trade visibility for false security.

Reviewed through automated stages and approved by a human before publication.