Veille CVE
CVE-2026-42174
4.3 MoyenneDescription
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, user avatar creation, replacement and deletion are not gated by user update permissions. This issue has been patched in versions 4.9.0 and 5.4.0.
Produits concernés
Scores CVSS
| Version | Score | Source | Vecteur |
|---|---|---|---|
| 4.0 | 5.3 Moyenne | security-advisories@github.com | CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X |
| 3.1 | 4.3 Moyenne | nvd@nist.gov (NVD) | CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Faiblesses (CWE)
Références
- https://github.com/getkirby/kirby/releases/tag/4.9.0 Release Notes
- https://github.com/getkirby/kirby/releases/tag/5.4.0 Release Notes
- https://github.com/getkirby/kirby/security/advisories/GHSA-39cp-6679-8xv2 PatchVendor Advisory