Kirby CMS 5.3.0-5.4.0 - Path Traversal

Kirby CMS versions 5.3.0 through 5.4.0 are vulnerable to a path traversal vulnerability via the /api/auth/login endpoint. An unauthenticated attacker may supply a specially crafted email value in the request body containing traversal sequences such as "../..", which the application concatenates...

exploit-CVE-2023-38490

Kirby XML External Entity XXE - CVE-2023-38490 exploit Kirby 3.9.6 XML External Entity Exploit for CVE-2023-38490 / GHSA-q386-w6fg-gmgp. Exploitation demonstration Build and run the vulnerable demo app: cd docker docker buildx build -t kirby-starterkit-3.9.5 . docker run -d --rm -p...

GHSA-6J4C-MGQR-QV76 Kirby: Access to image files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed in a way that their index root on the server is next to a second directory that is read-accessible to PHP and shares the same name prefix such as the site with the index root /var/www/site being next to /var/www/site2. It was...

EUVD-2026-68811

Kirby: Access to image files outside of the site root via path traversal in the media handling...

Kirby: Access to image files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed in a way that their index root on the server is next to a second directory that is read-accessible to PHP and shares the same name prefix such as the site with the index root /var/www/site being next to /var/www/site2. It was...

GHSA-RF2P-VH74-7VVH Kirby: System path exposure from error messages in the REST API

TL;DR This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' = false option. It was possible to trigger a PHP error in the API backend that would expose the full filesystem path of the Kirby installation on the server. This could be used to guess the default...

EUVD-2026-54577

Kirby: System path exposure from error messages in the REST API...

Kirby: System path exposure from error messages in the REST API

TL;DR This vulnerability affects all Kirby sites that have not disabled the REST API with the 'api' = false option. It was possible to trigger a PHP error in the API backend that would expose the full filesystem path of the Kirby installation on the server. This could be used to guess the default...

GHSA-67MX-6WF2-92XP Kirby: File upload permissions are not checked during processing of chunk data

TL;DR This vulnerability affects all Kirby sites where users of a particular role have access to the REST API access.panel permission is enabled but no permission to upload any kind of file files.create, files.replace and user/users.update permissions are all disabled. It was possible to fill up...

Kirby: File upload permissions are not checked during processing of chunk data

TL;DR This vulnerability affects all Kirby sites where users of a particular role have access to the REST API access.panel permission is enabled but no permission to upload any kind of file files.create, files.replace and user/users.update permissions are all disabled. It was possible to fill up...

GHSA-9VX2-J98C-P72W Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes %2f, such as nginx, PHP's built-in server or Apache setups that have the option AllowEncodedSlashes enabled. It was possible to create and access thumbnails from media...

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes %2f, such as nginx, PHP's built-in server or Apache setups that have the option AllowEncodedSlashes enabled. It was possible to create and access thumbnails from media...

CVE-2026-75594

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

CVE-2026-71415

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process before Kirby\Api\Upload::processChunk persisted chunk data. An authenticated...

CVE-2026-75592

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\Filesystem\Dir::realpath and Kirby\Filesystem\F::realpat...

CVE-2026-75594 Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

CVE-2026-75594

Kirby , an open-source CMS, is affected by a path traversal vulnerability in its media handler (src/Cms/Media.php, Kirby\Cms\Media::thumb()) and the file::version path (src/Filesystem/Asset.php). On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote unauthenticated...

EUVD-2026-68813

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

CVE-2026-75594 Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

CVE-2026-75594 Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...