CVE-2026-41325: 
PHP vulnerability analysis and mitigation

CVE-2026-41325 is an incorrect authorization vulnerability in Kirby CMS that allows authenticated low-privileged users to bypass create permission checks during page, file, and user creation by injecting custom dynamic blueprint configuration into model data. It affects all Kirby installations prior to version 4.9.0 (in the 4.x branch) and versions 5.0.0 through 5.3.3 (in the 5.x branch). The vulnerability was responsibly disclosed by researcher @offset and published on April 23–24, 2026. It carries a CVSS v4 score of 7.1 (High) and a CVSS v3.1 score of 8.8 (High) (GitHub Advisory, Github Advisory).

The root cause is classified as CWE-863 (Incorrect Authorization): Kirby's page, file, and user creation APIs did not filter the blueprint property from incoming model data, allowing attackers to inject arbitrary dynamic blueprint configuration into creation requests. By supplying a crafted payload containing 'create' => true within the blueprint options, an attacker could override the options defined in both user blueprints (site/blueprints/users/...) and model blueprints (site/blueprints/pages/...), effectively nullifying administrator-configured permission restrictions. The attack is network-accessible, requires only low-level authenticated access, and has no additional complexity or user interaction requirements. The fix involved updating the normalization code used during creation operations to explicitly filter out the blueprint property, preventing injection (GitHub Advisory, Github Advisory).

Successful exploitation allows authenticated users with restricted roles to bypass administrator-configured permission controls and perform unauthorized creation of pages, files, and user accounts — including potentially administrative accounts. This can lead to privilege escalation, injection of malicious content into the CMS, unauthorized access to sensitive data stored within models, and persistent unauthorized access through rogue admin account creation. Sites where all users are already permitted to create pages, files, and users are not affected; only sites with explicit create permission restrictions are at risk (GitHub Advisory, Kirby 5.4.0 Release).

No public proof-of-concept exploit code is known to exist, and there is no evidence of in-the-wild exploitation at this time (Github Advisory). The vulnerability is not listed in the CISA Known Exploited Vulnerabilities (KEV) catalog. The EPSS score is approximately 0.041% (13th percentile), indicating a low near-term exploitation probability. Exploitation requires valid low-privileged credentials on the target Kirby CMS instance, limiting opportunistic mass exploitation.

1. Reconnaissance: Identify a target Kirby CMS instance running a version prior to 4.9.0 or between 5.0.0 and 5.3.3. Confirm that at least one user role has pages.create, files.create, or users.create permissions disabled in the site blueprints.
2. Obtain low-privileged credentials: Authenticate to the Kirby Panel or REST API using a low-privileged account (e.g., an editor role that lacks create permissions).
3. Craft malicious creation request: Construct an API request to the page, file, or user creation endpoint (e.g., a POST to the Kirby REST API for creating a page or user), and include a blueprint property in the model data payload containing 'options' => ['create' => true].
4. Submit the request: Send the crafted request to the target. Because the normalization code does not filter the blueprint property, the injected options override the administrator-configured permissions, and the creation action is permitted.
5. Achieve objective: Depending on the target permission, the attacker can create unauthorized pages (potentially injecting malicious content), upload unauthorized files, or create new user accounts — including accounts with elevated roles — enabling persistent access or further privilege escalation (GitHub Advisory).

• Logs: Kirby Panel or REST API access logs showing creation requests (POST) to page, file, or user creation endpoints from accounts whose roles should not have create permissions; unexpected successful 201 Created responses for such accounts.
• File System: Unexpected new pages, files, or user accounts created in the Kirby content directory (/content/) or user directory (/site/accounts/) that do not correspond to authorized activity.
• Application: Presence of newly created user accounts with elevated roles (e.g., admin) that were not provisioned by site administrators; unexpected content or files appearing in the CMS that restricted users should not have been able to create.
• Network: Unusual API calls to Kirby's REST API creation endpoints (e.g., /api/pages, /api/files, /api/users) from authenticated sessions of low-privileged users, particularly with blueprint or options parameters in the request body (GitHub Advisory).

Upgrade Kirby to version 4.9.0 (for 4.x installations) or 5.4.0 (for 5.x installations), both released on April 23, 2026. These versions update the normalization code in the page, file, and user creation APIs to filter the blueprint property from incoming model data, preventing blueprint injection. No configuration-based workaround is available; patching is the only remediation. As an interim risk-reduction measure, review and audit user roles to minimize the number of accounts with any Panel access, and monitor creation activity logs for anomalies (Kirby 4.9.0 Release, Kirby 5.4.0 Release, GitHub Advisory).

The vulnerability was responsibly reported by researcher @offset and disclosed by Kirby maintainer bastianallgeier via GitHub Security Advisories on April 23, 2026. The release notes for Kirby 5.4.0 note that this was one of several security issues fixed in a coordinated security release, indicating a broader security audit effort. No significant independent researcher commentary or major media coverage has been identified beyond standard CVE aggregator reporting (Kirby 5.4.0 Release, GitHub Advisory).