SHSelfHostIndex
PA

Pagekit

Modular and lightweight CMS with a modern interface

Content Management Systems Archived ★ 5.5k stars Easy setup MIT

This project is archived. Upstream development has stopped, so expect no new features or security fixes. Consider an actively maintained content management systems alternative.

Pagekit is a modular, open-source content management system with a clean, modern interface built on Symfony components and Vue.js. It includes a blog and a marketplace for extensions.

Official siteSource code

Key features

  • Modern Vue.js interface
  • Modular architecture
  • Built-in blog
  • Marketplace for extensions

Pros & cons

Strengths

  • Clean, modern admin
  • Lightweight

Trade-offs

  • Development has stalled
  • Limited active maintenance

Is Pagekit secure?

9 known vulnerabilities affect Pagekit's latest release (1.0.18) according to OSV.dev; the most severe is rated critical.

Affecting 1.0.18

AdvisorySeveritySummary
CVE-2025-67164CriticalAn authenticated arbitrary file upload vulnerability in the /storage/poc.php component of Pagekit CMS v1.0.18 allows attackers to execute arbitrary code via uploading a crafted PHP file.
CVE-2021-44135Criticalpagekit all versions, as of 15-10-2021, is vulnerable to SQL Injection via Comment listing.
CVE-2022-38916CriticalA file upload vulnerability exists in the storage feature of pagekit 1.0.18, which allows an attacker to upload malicious files
CVE-2025-67165CriticalAn Insecure Direct Object Reference (IDOR) in Pagekit CMS v1.0.18 allows attackers to escalate privileges.
CVE-2026-57518HighPagekit CMS 1.0.18 Privilege Escalation via UserApiController
CVE-2021-32245MediumIn PageKit v1.0.18, a user can upload SVG files in the file upload portion of the CMS.
CVE-2024-45967MediumPagekit 1.0.18 is vulnerable to Cross Site Scripting (XSS) in index.php/admin/site/widget.
CVE-2022-36573UnknownA cross-site scripting (XSS) vulnerability in Pagekit CMS v1.0.18 allows attackers to execute arbitrary web scripts or HTML via a crafted payload injected into the Markdown text box under /blog/pos...
CVE-2023-41005UnknownAn issue in Pagekit pagekit v.1.0.18 alows a remote attacker to execute arbitrary code via thedownloadAction and updateAction functions in UpdateController.php
  • Most recent fixed advisory CVE-2019-19013, published 2019-11-22 (2518 days ago)

Source: OSV.dev, checked 2026-10-14. How this is measured.

Pagekit replaces

Self-hosted WordPress alternatives

Health badge

Maintain Pagekit? Add its health score to your README. The badge links back to this page.

SelfHostIndex: 15 · archived

Markdown
[![SelfHostIndex health score for Pagekit](https://selfhostindex.com/badge/pagekit.svg)](https://selfhostindex.com/app/pagekit/)
HTML
<a href="https://selfhostindex.com/app/pagekit/"><img src="https://selfhostindex.com/badge/pagekit.svg" alt="SelfHostIndex health score for Pagekit"></a>
reStructuredText
.. image:: https://selfhostindex.com/badge/pagekit.svg
   :alt: SelfHostIndex health score for Pagekit
   :target: https://selfhostindex.com/app/pagekit/

The score is recomputed on every nightly rebuild from public repository data — see how it is calculated.

Compare Pagekit

21 head-to-head comparisons.

Similar content management systems apps