Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

TL;DR This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes %2f, such as nginx, PHP's built-in server or Apache setups that have the option AllowEncodedSlashes enabled. It was possible to create and access thumbnails from media...

CVE-2026-75594

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache...

CVE-2026-75592

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\Filesystem\Dir::realpath and Kirby\Filesystem\F::realpat...

CVE-2026-75592 Kirby: Access to image files outside of the site root via path traversal in the media handling

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\Filesystem\Dir::realpath and Kirby\Filesystem\F::realpat...

CVE-2026-75592 Kirby: Access to image files outside of the site root via path traversal in the media handling

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\Filesystem\Dir::realpath and Kirby\Filesystem\F::realpat...

PT-2026-83996

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.5 Kirby versions prior to 5.5.2 Description The media handler in this content management system uses incomplete filesystem containment checks within src/Filesystem/Dir.php and src/Filesystem/F.php via the functions...

CVE-2026-52491

An issue in libtiff 85f2ac8e0b01cb7db2bbecf4a3b891bdbef67938 allows an attacker to execute arbitrary code via the libtiff/tools/thumbnail.c: main component...

CVE-2026-67446

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-67446

Mailpit , an email testing tool and API for developers, is vulnerable to a memory exhaustion issue in its thumbnail generation endpoint (GET /api/v1/message/{id}/part/{partID}/thumb). The handler in server/apiv1/thumbnails.go calls imaging.Decode() with AutoOrientation on attacker-supplied image ...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

CVE-2026-67446 Mailpit: Thumbnail generation decodes unbounded image dimensions before scaling

Mailpit is an email testing tool and API for developers. Prior to 1.30.4, Mailpit decodes attacker-supplied image attachments into a full raster before checking decoded dimensions, pixel count, or memory use in the GET /api/v1/message/id/part/partID/thumb endpoint. The Thumbnail handler in...

PT-2026-79138

Name of the Vulnerable Software and Affected Versions Mailpit versions prior to 1.30.4 Description Mailpit decodes image attachments into a full raster before verifying decoded dimensions, pixel count, or memory usage. This occurs in the GET '/api/v1/message/id/part/partID/thumb' endpoint. The...

GO-2026-6100 Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server in github.com/cloudreve/Cloudreve

Cloudreve: Denial of Service - Image decompression / pixel bomb in thumbnail & avatar decoding crashes the server in github.com/cloudreve/Cloudreve...

CVE-2026-14863

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-14863 FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-14863

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-14863 FileRun 2026.2.0 RCE via Thumbnail Generation Command Injection

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

EUVD-2026-56976

FileRun up to and including version 2026.2.0 contains an OS command injection vulnerability that allows authenticated attackers to achieve remote code execution by uploading a file with a malicious filename containing shell command substitution sequences. The thumbnail generation system passes...

CVE-2026-14863

FileRun

PT-2026-70913

Name of the Vulnerable Software and Affected Versions FileRun versions prior to 2026.2.1 Description Authenticated attackers can achieve remote code execution through an OS command injection. The issue occurs when the thumbnail generation system passes filenames wrapped in shell double-quotes...