Easily map the attack path and prioritize which CVEs are a threat to your organization
Miggo AIGenerate vendor-ready rules for the observed attack patterns, plus reasoning and safe deployment guidance
| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| getkirby/cms | composer | <= 4.9.4 | 4.9.5 |
| getkirby/cms | composer | >= 5.0.0, < 5.5.2 | 5.5.2 |
Miggo AIRoot Cause AnalysisThe vulnerability, CVE-2026-69127, describes a system path exposure in the Kirby REST API due to unsanitized PHP error messages. The provided commit 58f819988436b31969078bc4655452dd48546451 (and its duplicate 469c5a1a2973811591d996bc967eead3565df1f0) directly addresses this issue.
Upon analyzing the patch, the most critical change is within the src/Api/Api.php file, specifically in the responseForException method. Before the fix, this method included the line -'message' => $e->getMessage(),, which directly assigned the exception's message to the API response. This meant that if an exception (e.g., a PHP error) contained sensitive information like file paths, it would be directly exposed.
The patch introduces logic to conditionally sanitize or replace the error message:
Kirby\Exception\ExceptionException, its message is considered safe and returned as is.disguiseFilePath method (from Kirby\Cms\AppErrors trait) to replace absolute paths with generic placeholders.Kirby\Exception\ExceptionException, a generic, translated error message (I18n::translate('error.unexpected')) is returned instead of the raw exception message.Therefore, the responseForException method is the vulnerable function because it was responsible for processing and outputting the error message without proper sanitization, leading to the path disclosure. The disguiseFilePath method is a mitigation introduced by the patch, not the vulnerable function itself.
Kirby\Api\Api::responseForExceptionsrc/Api/Api.php