CVE-2026-34587: CVE-2026-34587: Server-Side Template Injection and Authorization Bypass in Kirby CMS

📰 Dev.to · CVE Reports

Learn about CVE-2026-34587, a server-side template injection and authorization bypass vulnerability in Kirby CMS, and how to mitigate it

intermediate Published 24 Apr 2026

Action Steps

Identify if your Kirby CMS version is affected by CVE-2026-34587
Update to the latest version of Kirby CMS to patch the vulnerability
Configure proper authorization and access controls to prevent bypass
Test for server-side template injection vulnerabilities using tools like Burp Suite
Implement a web application firewall (WAF) to detect and prevent similar attacks

Who Needs to Know This

Developers and security teams using Kirby CMS should be aware of this vulnerability to protect their applications from potential attacks

Key Insight

💡 Server-side template injection and authorization bypass vulnerabilities can be devastating, so keeping your CMS up-to-date and configuring proper security controls is crucial