CVE-2026-75594
HighCVSS 8.2Exploitation Probability (EPSS)
Low risk42th percentile - higher than 42% of all known CVEs
Summary
Kirby is an open-source content management system. Prior to versions 4.9.5 and 5.5.2, the media handler in src/Cms/Media.php allowed Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.
Risk Assessment
An attacker can access files outside the media directory, potentially leading to disclosure of sensitive data or file deletion.
Recommendation
Update Kirby to version 4.9.5 or 5.5.2 (or later) depending on the release line used.
Other vulnerabilities in Kirby
See all- CVE-2026-54003Critical
A vulnerability in the Kirby content management system allows a remote attacker to bypass local IP checks and install the Panel and create the first admin account. The issue affects versions prior to 4.9.4 and 5.4.4 when the server runs behind a reverse proxy that sets the Forwarded, X-Client-IP, or X-Real-IP request headers.
- CVE-2026-75592Medium
Kirby is an open-source CMS. Prior to 4.9.5 and 5.5.2, the media handler used incomplete filesystem containment checks, allowing access to files in sibling directories if the path shared a common prefix. A remote attacker could create and access thumbnails from image files in a sibling directory, potentially exposing staging sites, backups, or other internal sites.
- CVE-2026-71415High
Kirby is an open-source content management system. From version 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.
- CVE-2026-69127Medium
A vulnerability in the Kirby content management system prior to version 4.9.5 and from 5.0.0 through 5.5.1 causes the REST API error handler to return unsanitized PHP error messages, exposing the full filesystem path of the Kirby installation to unauthenticated API users. This affects all sites that have not disabled the REST API with the 'api' => false option. The issue is fixed in versions 4.9.5 and 5.5.2.
- CVE-2026-54005High
In Kirby CMS before versions 4.9.4 and 5.4.4, users with the pages.access permission disabled could retrieve full content and metadata of any published page via the /api/site/find endpoint by knowing page IDs or UUIDs. This vulnerability allowed unauthorized access to pages that should have been protected.
- CVE-2026-42137Medium
In Kirby (content management system) versions prior to 4.9.0 and 5.4.0, the `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API.
- CVE-2026-42069Medium
Kirby prior to versions 4.9.0 and 5.4.0 does not gate read access to site, user and role information by permissions, allowing unauthorized users to access this data.
- CVE-2026-42051Medium
Kirby is an open-source content management system. Prior to versions 4.9.0 and 5.4.0, the system API endpoint leaks license data and installed version to authenticated users. This issue has been patched in versions 4.9.0 and 5.4.0.
- CVE-2018-14519Medium
In Kirby 2.5.12, a CSRF vulnerability was found in the delete page functionality. A remote attacker can craft a malicious CSRF page and force the user to delete a page.
Original NVD description (English source)
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.