7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Concerned about an active attack path?

Talk to our security experts and see Miggo in action.

Miggo Vulnerability Database

→

CVE-2026-41325

CVE-2026-41325: Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection

Kirby is an open-source content management system. Kirby's user permissions control which user role is allowed to perform specific actions to content models in the CMS. These permissions are defined for each role in the user blueprint (site/blueprints/users/...). It is also possible to customize the permissions for each target model in the model blueprints (such as in site/blueprints/pages/...) using the options feature. The permissions and options together control the authorization of user actions. Kirby provides the pages.create, files.create and users.create permissions (among others). These permissions can again be set in the user blueprint and/or in the blueprint of the target model via options. Prior to versions 4.9.0 and 5.4.0, Kirby allowed to override the options during the creation of pages, files and users by injecting custom dynamic blueprint configuration into the model data. The injected options could include 'create' => true, which then caused an override of the permissions and options configured by the site developer in the user and model blueprints. The problem has been patched in Kirby 4.9.0 and Kirby 5.4.0. The patched versions have updated the normalization code that is used during the creation of pages, files and users to include a filter for the blueprint property. This prevents the injection of dynamic blueprint configuration into the creation request.

(GitHub Advisory)

Miggo Vulnerability Database

→

CVE-2026-41325

CVE-2026-41325:

7.1

CVSS Score

4.0

-

CVSS Score

Basic Information

Is this CVE running in your environment?

Easily map the attack path and prioritize which CVEs are a threat to your organization

Validate Exposure

Technical Details

Package Name	Ecosystem	Vulnerable Versions	First Patched Version
getkirby/cms	composer	< 4.9.0	4.9.0
getkirby/cms	composer	>= 5.0.0, < 5.4.0	5.4.0

Technical Details

Vulnerability Intelligence
Miggo AI

Root Cause Analysis

The vulnerability allows authenticated users to bypass authorization checks when creating pages, files, or users. This is due to the improper handling of the blueprint parameter in the create methods of the Page, File, and User models. The analysis of the security patch (commit f12ed3efa7656d84eb0aed4b1c6915075188bd46) reveals that the vulnerability is fixed by explicitly unsetting the blueprint key from the properties array ($props) at the beginning of the create methods in the PageActions, FileActions, and UserActions traits. This prevents attackers from injecting a custom blueprint with elevated privileges (e.g., setting 'create' => true in the options). The vulnerable functions are the create methods within these traits, which are utilized by their respective CMS model classes (Page, File, User). Therefore, any runtime profile during exploitation would show calls to Kirby\Cms\Page::create, Kirby\Cms\File::create, or Kirby\Cms\User::create as the entry points for the vulnerable operation.

Vulnerable functions

Kirby\Cms\FileActions::create

src/Cms/FileActions.php

The `create` function in the `FileActions` trait (used by the `File` class) was vulnerable to an authorization bypass. Before the patch, it was possible to inject a 'blueprint' property in the `$props` array. This allowed an attacker to provide a custom blueprint with modified permissions, such as `'create' => true`, bypassing the intended security restrictions. The patch mitigates this by unsetting the 'blueprint' property from the input array, ensuring that only the system-defined blueprints are used.

Kirby\Cms\PageActions::create

src/Cms/PageActions.php

The `create` function in the `PageActions` trait (used by the `Page` class) was vulnerable to an authorization bypass. Before the patch, it was possible to inject a 'blueprint' property in the `$props` array. This allowed an attacker to provide a custom blueprint with modified permissions, such as `'create' => true`, bypassing the intended security restrictions. The patch mitigates this by unsetting the 'blueprint' property from the input array, ensuring that only the system-defined blueprints are used.

Kirby\Cms\UserActions::create

src/Cms/UserActions.php

The `create` function in the `UserActions` trait (used by the `User` class) was vulnerable to an authorization bypass. Before the patch, it was possible to inject a 'blueprint' property in the `$props` array. This allowed an attacker to provide a custom blueprint with modified permissions, such as `'create' => true`, bypassing the intended security restrictions. The patch mitigates this by unsetting the 'blueprint' property from the input array, ensuring that only the system-defined blueprints are used.

Vulnerability Intelligence
Miggo AI

Unlock WAF rules for this CVE

Generate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance

Get WAF rules

WAF Protection Rules

WAF Rule

W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.W** rul*s *v*il**l* *or Mi**o *ustom*rs only.

Reasoning

*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.*v*il**l* *or Mi**o *ustom*rs only.