Tests, a changelog, and release notes provide useful context. Ongoing maintenance and security support have ended, making this legacy CMS a substantial dependency risk.
12%
Total Score
50
50
83
Packagist marks the package as abandoned at package scope, with no replacement listed. This is a direct warning that developers should not start new dependencies on it.
The package had 25 releases but none in the last 12 months; its latest release was published on December 1, 2020. The long release gap indicates abandonment rather than a maintained release cadence.
The repository recorded zero commits and zero active maintainers during the last three months. This provides concrete evidence that the project is no longer being actively maintained.
The linked repository is archived, and its last push was on January 25, 2021. An archived source repository signals that maintenance and issue handling have ended.
The repository has no security policy. For an archived CMS with no recent development activity, the absence of a documented security process increases the risk of unresolved vulnerabilities.
| Title | Versions | Severity |
|---|---|---|
CVE-2025-30159 getkirby/kirby is vulnerable to Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in versions 0.0.0 - 3.9.8.3, 3.10.0 - 3.10.1.2 and 4.0.0 - 4.7.1. | 0.0.0 - 3.9.8.33.10.0 - 3.10.1.24.0.0 - 4.7.1 | Medium |
CVE-2018-16630 getkirby/kirby is vulnerable to Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') in versions 0.0.0 - 2.5.12. | 0.0.0 - 2.5.12 | Medium |
| Dependency | Last Release | Score |
|---|---|---|
filp/whoops Version 2.1.14 | — | — |
erusev/parsedown Version 1.7.1 | — | — |
getkirby/toolkit Version 2.5.14 | — | — |
erusev/parsedown-extra Version 0.7.1 | — | — |
michelf/php-smartypants Version 1.8.1 | — | — |
Connect your repositories to instantly see whether vulnerable or malicious packages exist in your codebase.
Free. No credit card required.

I consent to receiving marketing communications based on Aikido’s Privacy Policy.
SOC 2Compliant
ISO 27001Compliant
ISO 42001Compliant© All Intel data is openly available and commercially licensed.