Detections
Analytics

CVE-2026-42174

medium

Description

Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user update permissions. This issue has been patched in versions 4.9.0 and 5.4.0.

References

https://github.com/getkirby/kirby/security/advisories/GHSA-39cp-6679-8xv2

https://github.com/getkirby/kirby/releases/tag/5.4.0

https://github.com/getkirby/kirby/releases/tag/4.9.0

Details

Source: Mitre, NVD

Published: 2026-05-09

Updated: 2026-05-18

Risk Information

CVSS v2

Base Score: 4

Vector: CVSS2#AV:N/AC:L/Au:S/C:N/I:P/A:N

Severity: Medium

CVSS v3

Base Score: 4.3

Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N

Severity: Medium

CVSS v4

Base Score: 5.3

Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Severity: Medium

EPSS

EPSS: 0.0003