Kirby 2.5.6

This minor release fixes some bugs and adds a few enhancements.

It also fixes a security issue that would give users with an invalid role the permissions of the default role. Kirby now falls back to a role without permissions to ensure that a user never has too many permissions. This issue only affects you if you are using custom roles and if one of your users has a role that doesn't exist or doesn't exist anymore.

Because of this fix, it is strongly recommended to upgrade to Kirby 2.5.6 if you are using custom roles.


  • The site blueprint can now limit the displayed pages in the pages dashboard widget #1036
  • Using the email button in the Textarea field now creates a Kirbytag even if no text is passed to make use of the entity encoding #1096
  • Updated translations
  • Enforce deletion of invalid uploaded files
  • Changing the page template on a multilang site now cleans up old files properly, even if the default language isn't defined first in the config.php #1077
  • Fixed an issue with structure fields not updating properly in the Panel in multilang sites #936
  • The $oldPage/$oldFile object in hooks is now more reliably using the actual old values #1025


  • Improvements to user role fallback if the user has an invalid role #603
  • Improved redirect for page URLs without language code (multilang) #541
  • Prevent loading order issues if a Site object is created from inside a configuration file #253
  • Page, File and User objects are now cloned recursively in memory when cloning using $page = clone $page #1025


Our partners

CDN by KeyCDN Search by Algolia