UpHeron
All vulnerabilities

Servers and applications

CVE-2020-26253

External Initialization of the Panel on .dev domains and some reverse proxy setups

Severity
Medium 5.9
Published
2 Dec 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
3.3.6
Also known as
GHSA-2ccx-2gf3-8xvv
Sources
NVD, Project advisories (GitHub)

Description

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.3.6, and Kirby Panel before version 2.5.14 there is a vulnerability in which the admin panel may be accessed if hosted on a .dev domain. In order to protect new installations on public servers that don't have an admin account for the Panel yet, we block account registration there by default. This is a security feature, which we…

Affected software

SoftwareAffected versions
KirbyServers and applications · cpe:a:getkirby:kirby
  • Every version before 3.3.6
KirbyServers and applications · github:getkirby/kirby
  • From 3.0.0 before 3.3.6

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2020-26253
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2020-26253
  • GitHub Advisory Database https://github.com/advisories/GHSA-2ccx-2gf3-8xvv
  • github.com https://github.com/getkirby/kirby/security/advisories/GHSA-2ccx-2gf3-8xvv