Hey everyone,
Next Wednesday, September 16, is going to be the day of the next planned security releases: Kirby 5.6.0 and 4.9.6.
Both releases will contain fixes for several vulnerabilities. All of them require an authenticated Panel user, or site and plugin code that passes untrusted input into Kirby’s create methods. Sites whose Panel users are all trusted are therefore not at direct risk.
Beyond these vulnerabilities, both releases will contain a number of additional hardening measures.
As in the previous months, we cannot provide detailed information about the vulnerabilities until the release. However feel free to ask if you have any questions about the release process.