🐛 Bug fixes

• Fix page/file link not being preselected when reopening the Writer link dialog #8289
• Restore support for the slugs config option in the Panel #8300
• Validating slug against protected paths when duplicating or moving a page #8311
• The filename is now correctly derived from the source when no filename is provided to File::create() #8316
• Fix Changes view for custom preview URLs #8317
• The Panel is no longer blocked by a deprecation warning when a user blueprint sets an undefined permission #8319

🧹 Housekeeping

• Updated JS dependencies

🚨 Security

Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

This vulnerability affects all Kirby sites that are deployed to a server that allows to request URLs with encoded slashes (%2f) such as nginx, the built-in PHP server or Apache setups that have the option AllowEncodedSlashes enabled.

It was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the .json file extension anywhere on the server.

This vulnerability is of high severity for affected sites.

Server setups running on Apache's default configuration or other servers that have been hardened against encoded slashes in URLs are not affected.

• CVE ID: CVE-2026-75594
• Severity: high (CVSS score 8.2)
• Advisory: GHSA-9vx2-j98c-p72w

Thanks to Jorge González Milla (@Pig-Tail) for responsibly reporting the identified issue.

File upload permissions are not checked during processing of chunk data

This vulnerability affects all Kirby sites where users of a particular role have access to the REST API (access.panel permission is enabled) but no permission to upload any kind of file (files.create, files.replace and user/users.update permissions are all disabled).

It was possible to fill up the temporary directory for chunked uploads with unfinished chunks even as a user without any upload permission.

This vulnerability is of high severity for affected sites.

Your Kirby sites are not affected if you intend all users of your site to be able to upload files. The vulnerability can only be exploited by authenticated users. It was not possible to bypass the actual permission checks for any files that end up in the content or site/accounts folders.

• CVE ID: CVE-2026-71415
• Severity: high (CVSS score 7.1)
• Advisory: GHSA-67mx-6wf2-92xp

Thanks to @alcls01111 for responsibly reporting the identified issue.

System path exposure from error messages in the REST API

This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' => false option.

It was possible to trigger a PHP error in the API backend that would expose the full filesystem path of the Kirby installation on the server. This could be used to guess the default content.salt or prepare specialized attacks.

• CVE ID: CVE-2026-69127
• Severity: moderate (CVSS score 6.9)
• Advisory: GHSA-rf2p-vh74-7vvh

Thanks to Peter Levashov (@petersevera) for responsibly reporting the identified issue.

Access to image files outside of the site root via path traversal in the media handling

This vulnerability affects all Kirby sites that are deployed in a way that their index root on the server is next to a second directory that is read-accessible to PHP and shares the same name prefix (such as the site with the index root /var/www/site being next to /var/www/site2).

It was possible to create and access thumbnails from media files within such sibling directories that have a valid thumbnail configuration (JSON job file). This can affect staging sites, site backups or other internal sites.

• CVE ID: CVE-2026-75592
• Severity: moderate (CVSS score 6.9)
• Advisory: GHSA-6j4c-mgqr-qv76

Thanks to @0x1saac for responsibly reporting the identified issue.

🚨 Security fixes

• Kirby\Filesystem\Dir::realpath()/Kirby\Filesystem\F::realpath(): Fixed path traversal via prefix match. Now requires an exact match or a DIRECTORY_SEPARATOR boundary.
• Kirby\Cms\Media::thumb(): Rejects path traversals via filenames
• The Asset class and asset() helper no longer accept paths with ../ sequences to protect against path traversal
• API: Disguise errors file paths in debug mode. When not in debug mode, only show a generic error.
• Chunked file uploads now verify the user's upload permission before any data is written, so users who are not allowed to upload can no longer leave partial files behind in site/cache/.uploads.
• Chunked uploads now enforce the file template's maxsize consistently across all chunks and reject requests that change the file template or total upload length between chunks.

🐛 Bug fixes

• Fixed site preview URL adhering to site.preview permission as well as pages.preview permission/option for the home page
• Fixed ModelPermissions::canFromCache() handling of $default argument, incl. proper caching of it
• Localize the "Invalid form with errors" save toast to the Panel language #8278

☠️ Deprecated

• For the site preview, currently the home page preview permission is checked alongside site.preview. The check for the home page pages.preview permission has been deprecated and will be removed in the next major release. Please use the site.preview permission.

🚨 Security

This is a backport of our security release for Kirby 5. For all details and vulnerabilities see: https://github.com/getkirby/kirby/releases/tag/5.5.2

We recommend all users upgrade to Kirby 5. If an upgrade is not possible, this security release is the alternative solution.

TL;DR:

Kirby 6.0.0-alpha.3 is an early developer preview. We plan for a final release in the second half of 2026. Kirby 6 will be a free upgrade for all Kirby 4 & 5 license holders.

New highlights in alpha 3

🚨 Security

All our security fixes and improvements from our Kirby 5 security releases

🔐 User security drawer

A single place on the user/account view to handle security-related matters, e.g. email, password, two-factor (TOTP) management

🔑 Panel authentication overhaul

The login view has been refactored from the ground up to be more driven by the backend. It now features a method picker, a challenge switcher, and centralized loading/error handling. Auth methods can now also authenticate without an email, enabling token/SSO-style plugin methods that don't key on email and plugins can ship their own login method, just like custom challenges. Passkey is coming …

🪪 Custom Passwords Policy

The new auth.passwords option allows you to define a custom password policy for all users.

// site/config/config.php

return [
    'auth' => [
        'passwords' => [
            'minlength' => 12,
            'uppercase' => true,
            'lowercase' => true,
            'digits'    => 2,
            'symbols'   => true
        ]
    ]
];

And more …

• 👩‍🎨 New Icons and components
• 🏎️ Various performance improvements
• 🪄 A huge Panel JS to Typescript migration
• 🐛 Various bug fixes and enhancements

Changelog

We are collecting all changes in our pre-release changelog, if you already want to dive deeper: https://github.com/getkirby/kirby/blob/6.0.0-alpha.3/CHANGELOG.md

✨ Enhancements

A (link:) tag with an unresolvable UUID (e.g. deleted page/file) threw an NotFoundException in the previous release, which turned the whole page into the error page. Instead of that drastic exception (added in #6085), we now handle the broken link inline: in debug mode a visible inline error (prefixed with an emoji and a kirby-broken-link class so it can be targeted via CSS, and in production the link is simply dropped (keeping its text). #7426

Debug on

(link: page://deleted-page)
→ <span class="kirby-broken-link">🚨 The link "page://deleted-page" cannot be found</span>

(link: page://deleted-page text: click here)
→ <span class="kirby-broken-link">🚨 The link "page://deleted-page" cannot be found for the link text "click here"</span>

Debug off

(link: file://deleted-file text: file)  → <span>file</span>
(link: page://deleted-page)             → (nothing)

🐛 Bug fixes

• Fixed broken type: html Panel field preview rendering #8242
• Restored link field model previews #8241
• Fixed plugin block previews registered as template strings #8252
• Added deprecation id for permission deprecate warnings #8253
• A broken (link:) tag no longer turns the whole page into the error page #8257
• Fix block navigation (prev/next) in the panel drawer #8264

🧹 Housekeeping

• Attaching files for local Lab to each release #7951

🎉 Features

Local development licenses

A Kirby site can now be activated as development site when you confirm to comply with the license terms for free development licenses. When the site is not set up locally, Kirby will regularly check that your development site is not publicly accessible. #7832

Frontmatter Data Handler

New Frontmatter Data handler, which can be used to import or export frontmatter into Kirby. #8019

Decoding

use Kirby\Data\Frontmatter;

$md = <<<MD
---
title: My new article
date: '2026-03-12'
---
# Hello world

This is my brand new article written in **Frontmatter/Markdown**
MD;

$result = Frontmatter::decode($md);

// [
//  'title' => 'My new article',
//  'date' => '2026-03-12',
//  'text' => '# Hello world ...'
// ]

Encoding

use Kirby\Data\Frontmatter;

$result = Frontmatter::encode([
  'title' => 'My new article',
  'date' => '2026-03-12',
  'text' => '# Hello world …'
]);

// ---
// title: My new article
// date: 2026-03-12
// ---
// # Hello world …

New translations

• Japanese (thanks to Kosuke Okahara)
• Ukranian

✨ Enhancements

• SmartyPants is directly using UTF-8 characters instead of HTML entities
• A page/site/user/file will now automatically be unlocked, as soon as the editor leaves the view or closes the tab/window. This will make sure that content-editing is not unnecessarily blocked for other editors. #7975
  • New Kirby\Content\Version::unlock() method
  • New panel.content.unlock() method
  • New /api/(:all)/changes/unlock route
• License dialog: Show registered domain and link to license terms #7832
• You can now use this.$helper.string.sanitizeHTML() in the Panel to create a clean HTML string with configurable marks and nodes. By default, the sanitizer will only keep inline marks (bold, code, italic, link, strike, sub, sup, underline) #7922

  this.$helper.string.sanitizeHTML('<p><marquee><strong onclick="alert(\'boo\')">Foo</strong></marquee></p>')
  // returns: <strong>Foo</strong>

  To set custom writer marks and nodes, you can pass an options object:

  this.$helper.string.sanitizeHTML(unsanitizedHTML, {
    marks: ["bold"],
    nodes: ["doc", "praagraph", "text")]
  });

• It's now possible to define any extension directly in your config, to be able to set site-specific extensions without creating a helper plugin. #8005

  // /site/config/config.php
  
  return [
    'extensions' => [
      'pageModels' => [
        // ...
      ],
      'blueprints' => [
        // ...
      ]
    ]
  ];

• Link field: reduced the amount of backend request fired directly when mounted (thx @tobimori) #8072
• Added some missing common/modern extensions to Kirby\Filesystem\F::$types and Kirby\Filesystem\Mime::$types. #8134
• New Kirby\Toolkit\A::flip() method #8132
• Increased length of randomly generated chunk IDs for chunked uploads to reduce risk of filename collisions #8182
• New Kirby\Filesystem\F::update($file, $callback) method that reads and updates a file under lock #8187
• Improved error handling for block snippet errors rendered via Kirby\Cms\Block::toHtml() by logging suppressed errors and escalating exceptions in debug mode #8085.
• Added a translatable default placeholder for the tags field input #6114

🏎️ Performance

• Improved performance of several system methods:
  • Kirby\Filesystem\Dir::size() #8131
  • Kirby\Filesystem\Mime::fromSvg() #8130
  • Kirby\Filesystem\Mime::toExtension() and Kirby\Filesystem\Mime::toExtensions() #8133
  • Kirby\Toolkit\Controller #8143
  • Kirby\Toolkit\Html::attr() and Kirby|Toolkit\Xml::encode() #8144
  • Kirby\Toolkit\Str::similarity(), Kirby\Toolkit\Str::startsWith(), Kirby\Toolkit\Str::endsWith(), Kirby\Toolkit\Str::encode(), Kirby\Toolkit\Str::ascii() #8138 #8147 #8145 #8158
  • Excluded keys lookup set in Kirby\Toolkit\A::without() #8146

🐛 Bug fixes

• Structure field previews: fields with HTML content (e.g. list, writer) do not expand the table with all their content anymore #7918
• Fixed URL validation for URLs with multiple hyphens #7942
• Redis cache driver: Fixed flushing all databases even when using a prefix. Now only the Reds database for the cache with its prefix gets flushed. #8148
• Fixed minWords/maxWords validators for non-single whitespace #8141
• Handle Dir::remove() with atomic rename #6266
• panel.request.body(null) does not send "null" to the backend as the request body anymore #8016
• Unset request headers aren't sent as "false" to the backend anymore but instead omitted from the request. #8016
• Fixed handling of partial step config arrays in Kirby\Toolkit\Date
• Kirby\Toolkit\LayzValue: fixed passing variadic arguments #8139
• Kirby\Toolkit\A::implode(): preserve falsy values when imploding array #8140
• Fixed fractional support for Kirby\Toolkit|Str::toBytes() #8159
• Blocks field: Fixed batch delete #8206
• Panel system view: The warning for the default cookie key is no longer displayed if a custom cookie key was set via the cookie.key option
• Panel: Fixed failing to load when a stricter Content-Security-Policy with nonce-based script-src is used. #8208
• I18n::template(): Prevent TypeError when $replace is null #8199
• Kirby queries: Fixed tokenizer position desync on multibyte characters (@thx @LaurentTacco) #8203
• Fixed a content lock deadlock in multilingual setups where saving a secondary language while another user holds the lock on the primary language would cause both users to see the page as locked by the other. #8099
• Fixed file sorting when a secondary language is active #8212
• Fixed Cmd/Ctrl+S in textarea toolbar dialogs inserting [object Object] instead of the formatted link/email text. #7934
• Disabled unselected model picker options once the field’s max limit is reached #8232
• Localize license hub link #8239

☠️ Deprecated

• Using arbitrary custom permissions without registering them first via the permissions extension has been deprecated. Those will be ignored in a future release, so make sure to define your custom permissions via the permissions extension. #8070
• Kirby\Text\KirbyTag::option() and Kirby\Text\KirbyTag::$options: Use $tag->kirby()->option() instead. #8196
• Kirby\Text\KirbyTags::parse(): $options parameter. Use new $debug parameter instead. #8196

♻️ Refactored

• New Kirby\Cms\LicenseStatus::Acknowledged and Kirby\Cms\LicenseType::Free cases #7832
• $helper.string.hasEmoji(): simplified regular expression #7966
• Started refactoring some of our JavaScript code as TypeScript for increased type-safety #7973
  • Migrated helpers to Typescript: $helper.array #7977, $helper.regex #7976
  • $helper.debounce/throttle #7980, $helper.isComponent #7982, $helper.embed #7983, $helper.keyboard #7984, $helper.isUploadEvent #7985, $helper.queue #7981, $helper.file #7990, $helper.field #7989, $helper.string #7979, $helper.link #7994, $helper.focus #7991, $helper.url #7992, $helper.page #7995, $library.colors #7997, $helper.clipboard #7988, $helper.upload #7996, dayjs plugins #8009, $helper.sort #7993
  • Migrated History and Timer as helper class to TypeScript #8010 #8011
  • Migrated first Panel state modules to TypeScript #8012 #8020 #8015, #8016, #8028, #8027, #8033, #8030, #8031, #8032, #8029, #8034, #8039, #8038, #8041, #8043, #8042
  • Types on this.$library, this.$helper and this.$esc are exposed in Vue SFC #8017
• New RedirectError error class with support in panel.error() #8016
• Refactored Permissions (thanks to @lukaskleinschmidt) #8004
  • Renamed Permissions::$actions property to $defaults; added separate protected array $actions populated by the constructor
  • Replaced 6 old methods (Permissions::setAll, Permissions::setCategory, Permissions::setCategories, Permissions::setAction, Permissions::hasAction, Permissions::hasCategory) with 4 cleaner ones: Permissions::normalize(), Permissions::expand(), Permissions::get(), Permissions::has()
  • Permissions::normalize() and Permissions::expand() handle all four input shapes: null, bool, ['cat' => bool], ['cat' => ['action' => bool]], including wildcard at both levels.
  • Permissions::for() now deprecates $category = null via Helpers::deprecated() and throws LogicException if a stored value is somehow not a bool
  • Slightly refactored the Blueprint class: array_fill_keys(array_keys($defaults), false) instead of array_map(fn () => false, $defaults).
• Ensure not wrapping <div> tags with <span> tags in <k-input> #8018
• New Kirby\Template\Snippet::hasSlots() method #8178
• Guard Slots in Snippets from being double-opened #8179
• New $debug parameter in Kirby\Text\KirbyTags::parse() #8196
• Clarify Html::rel() use #8142

🚨 Breaking changes

• Kirby\Cms\Block::toHtml() now throws block snippet exceptions in debug mode instead of returning an inline Block error message. While this is technically a breaking change, we see this as a debugging enhancement which can clearly go into a minor release without negative impact for real-world projects.

🧹 Housekeeping

• Extended our contributing guidelines #7949
• Use cpx for pinned composer dependencies shared between local dev and CI
• Replace jsdom with happy-dom for frontend unit tests #7971
• New...

🚨 Security

🛎️ Recommendation to secure your content salt and cookie key values

Kirby internally relies on the following values:

• The content.salt option is used to generate secure preview and media URLs that should not be guessable by external visitors.
• The Kirby\Http\Cookie::$key property, to sign (or authenticate) cookie values to prevent easy tampering with cookie values that have been set from the backend.

We recommend to set the content.salt and Kirby\Http\Cookie::$key values to long random strings for all of your sites.

We have updated the security guide with a section on this topic and added warnings to the Panel system view if Kirby detects the unchanged defaults.

Thanks to @adrgs and Peter Levashov (@petersevera) for their responsible disclosure and suggestion.

External Initialization of the Panel on reverse proxy setups with the Forwarded, X-Client-IP or X-Real-IP header

This vulnerability affects Kirby sites that have no configured user accounts and are running on publicly accessible servers behind a reverse proxy that sets the Forwarded: for=..., X-Client-IP, or X-Real-IP request header.

It was possible to install the Panel (= create the first admin user) in these setups even from remote IP addresses.

This vulnerability is of critical severity for affected sites.

Your site is not affected if any of the following apply:

• An admin account has already been configured
• The Panel and API are disabled
• The site is not running behind a reverse proxy
• The reverse proxy sets the X-Forwarded-For or Client-IP header instead of the affected ones.

Advisory Details:

• CVE ID: CVE-2026-54003
• Severity: critical (CVSS score 9.1)
• Advisory: GHSA-whxw-24jc-cwmv

Thanks to Peter Levashov (@petersevera) for responsibly reporting the identified issue.

Cross-site scripting (XSS) from incomplete HTML/XML sanitization in Dom::sanitize()

This vulnerability affects Kirby sites and plugins that use the writer or list fields or that use $dom->sanitize(), Sane::sanitize(), Sane\Html::sanitize(), Sane\Svg::sanitize(), Sane\Xml::sanitize(), Sane::sanitizeFile() or $file->sanitizeContents() with untrusted input.

It was possible to inject malicious markup as children of an unknown HTML/XML tag, which would then be passed through Dom::sanitize() without being correctly sanitized according to the provided sanitization rules, causing a cross-site scripting (XSS) risk.

This vulnerability is of high severity for affected sites.

The default file upload protection is not affected, so sites that only validate uploaded files are not exposed to this vulnerability. The vulnerability can only be exploited by authenticated users.

• CVE ID: CVE-2026-54002
• Severity: high (CVSS score 8.5)
• Advisory: GHSA-wr9h-4r83-f4v6

Thanks to Shafiq Aiman (@shafiqaimanx) for responsibly reporting the identified issue.

Self cross-site scripting (self-XSS) in the writer field

This vulnerability affects Kirby sites that use the writer field in any blueprint.

It was possible to include a scripting link as the target of a link (or email link). This link target would then be clickable by the user who entered it.

A successful attack commonly requires knowledge of the content structure by the attacker as well as social engineering of a user with access to the Panel. The attack cannot be automated.

In Kirby's default configuration, the vulnerability is limited to self-XSS and cannot directly affect other users or visitors of the site. Panel plugins that are directly using the <k-writer> component may also be affected by stored XSS if they don't sanitize the resulting HTML before saving it to the content.

This vulnerability is of high severity for affected sites.

• CVE ID: CVE-2026-49276
• Severity: high (CVSS score 7.4)
• Advisory: GHSA-rhj6-r49h-5932

pages.access permission is not checked in the site/find REST API route

This vulnerability affects all Kirby sites where users of a particular role have no permission to access pages (pages.access permission is disabled). This can be due to configuration in the user blueprint(s), options in the model blueprint(s), or a combination of both settings.

It was possible to retrieve page information (including full content and metadata) for arbitrary pages via the /api/site/find route without being authorized to access the respective pages.

This vulnerability is of high severity for affected sites.

Your Kirby sites are not affected if you intend all users of your site to be able to access all pages of the site. The vulnerability can only be exploited by authenticated users that know or guess the IDs or UUIDs of pages. Write actions as well as access to draft pages are not affected by this vulnerability.

• CVE ID: CVE-2026-54005
• Severity: high (CVSS score 7.1)
• Advisory: GHSA-r3w8-2c5r-h9j9

Thanks to Rizky Muhammad (@EvidentObscurity) for responsibly reporting the identified issue.

Request header injection in Http\Remote

This vulnerability affects Kirby sites and plugins that use the Kirby\Http\Remote class (including Remote::request(), Remote::get(), Remote::post(), and similar helpers) to send outgoing HTTP requests and that pass untrusted, user-controlled data into the headers option of such a request.

By including newline characters in the value of the header, it was possible to inject a separate, independent header that was not intended to be set.

A successful attack requires that an application or plugin forwards attacker-influenced input into a request header value. Sites that only send static, developer-defined headers are not affected. The attack does not target Panel users or site visitors directly; it targets the remote service that Kirby connects to.

In Kirby's default configuration, the Remote class is not exposed to untrusted input, so a default installation is not affected. The vulnerability becomes relevant for custom code, plugins, or integrations that build request headers from user input.

• CVE ID: CVE-2026-50188
• Severity: moderate (CVSS score 6.9)
• Advisory: GHSA-4v4h-m2qq-ppgw

Access to files of top-level drafts is not protected by permissions

This vulnerability affects Kirby 5 sites that have the content.fileRedirects option enabled (set to true or a custom closure) as well as all Kirby 4 sites that haven't explicitly disabled this option.

It was possible to access clean file URLs of top-level drafts (e.g. /about-us/team.jpg) without providing authentication, without being authorized to access the top-level draft page, and without providing a valid preview token.

Sites on Kirby 5 using the default configuration are not affected by this vulnerability (the content.fileRedirects option is disabled by default since Kirby 5.0.0). It was also not possible to maliciously access clean file URLs for files stored in page drafts that are not on the top-level (such as /blog/article/resource.pdf).

• CVE ID: CVE-2026-54004
• Severity: moderate (CVSS score 6.3)
• Advisory: GHSA-89cp-7p28-jffg

Thanks to @adamyordan for responsibly reporting the identified issue.

pages.access permission is not checked in the pages picker for parent pages

This vulnerability affects all Kirby sites that use the pages field and where users of a particular role have no permission to access pages (pages.access permission is disabled). This can be due to configuration in the user blueprint(s), options in the model blueprint(s), or a combination of both settings.

It was possible to confirm the existence of arbitrary pages and to retrieve the value of the title field of the pages found.

The vulnerability can only be exploited by authenticated users. Write actions are not affected by this vulnerability.

• CVE ID: CVE-2026-49274
• Severity: moderate (CVSS score 5.3)
• Advisory: GHSA-23q2-54qv-rq5x

🚨 Security fixes

• The link and email marks of the writer field are now protected against self-cross site scripting (self-XSS) from inserted scripting links
• The page picker in the pages field now consistently checks the pages.access permission for the provided parent page
• Results of the site/find API route are now filtered to only return pages that are accessible to the current user.
• Files on draft pages are no longer exposed through clean file URLs when content.fileRedirects is enabled.
• Kirby no longer allows to install the Panel with the first user account if a Forwarded: for=..., X-Client-IP or X-Real-IP request header with external IP address was provided by a reverse proxy.
• Show warnings in the system view when the content.salt option and Cookie::$key default values have not been changed.

✨ Enhancements

• Harden TO...

🚨 Security

This is a backport of our security release for Kirby 5. For all details and vulnerabilities see: https://github.com/getkirby/kirby/releases/tag/5.4.4

We recommend all users upgrade to Kirby 5. If an upgrade is not possible, this security release is the alternative solution.

🐛 Bug fixes

• Throw exceptions for UUID cache misses when content.uuid.index = false is set only in debug mode #8150

🚨 Security

• Updated PHP and JS dependencies

🚨 Security

• Updated PHP and JS dependencies