Package Health

getkirby/kirby

Tests, a changelog, and release notes provide useful context. Ongoing maintenance and security support have ended, making this legacy CMS a substantial dependency risk.

Latest 2.5.14PackagistPackagist

12%

Total Score

Maintainer Stability
Maintainer Stability
Assesses the consistency and reliability of package maintainers

50

Maturity
Maturity
Indicates package age, release frequency, and adoption metrics

50

Supply Chain
Supply Chain
Evaluates supply chain security practices and risks

83

Are you affected? Scan for Free

Health Score Breakdown

Registry deprecationdanger

Packagist marks the package as abandoned at package scope, with no replacement listed. This is a direct warning that developers should not start new dependencies on it.

Release historydanger

The package had 25 releases but none in the last 12 months; its latest release was published on December 1, 2020. The long release gap indicates abandonment rather than a maintained release cadence.

Repo commit activitydanger

The repository recorded zero commits and zero active maintainers during the last three months. This provides concrete evidence that the project is no longer being actively maintained.

Repository archiveddanger

The linked repository is archived, and its last push was on January 25, 2021. An archived source repository signals that maintenance and issue handling have ended.

Security policycaution

The repository has no security policy. For an archived CMS with no recent development activity, the absence of a documented security process increases the risk of unresolved vulnerabilities.

Vulnerabilities

TitleVersionsSeverity
CVE-2025-30159
getkirby/kirby is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 3.9.8.3, 3.10.0 - 3.10.1.2 and 4.0.0 - 4.7.1.
0.0.0 - 3.9.8.33.10.0 - 3.10.1.24.0.0 - 4.7.1
Medium
CVE-2018-16630
getkirby/kirby is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.5.12.
0.0.0 - 2.5.12
Medium

Package versions

Maintainers

Bastian Allgeier

Direct Dependencies

DependencyLast ReleaseScore
filp/whoops
Version 2.1.14
—
—
erusev/parsedown
Version 1.7.1
—
—
getkirby/toolkit
Version 2.5.14
—
—
erusev/parsedown-extra
Version 0.7.1
—
—
michelf/php-smartypants
Version 1.8.1
—
—

Weekly Downloads

Info

Last Published
5 years ago
Created
9 years ago

Are You Affected?

Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.

Free. No credit card required.

Aikido Platform