Vulnerability-Lookup

CVE-2026-75594 (GCVE-0-2026-75594)

Vulnerability from cvelistv5 – Published: 2026-08-31 20:53 – Updated: 2026-09-01 14:31

Title

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Summary

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.

Severity

8.2 (High)


                        
                          CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

SSVC

Exploitation: none Automatable: no Technical Impact: partial

CISA Coordinator · CISA-ADP (v2.0.3)

Decision recorded 2026-09-01 14:31 UTC

CWE

CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

Assigner

GitHub_M mitre root

References

7 references

URL	Tags
https://github.com/getkirby/kirby/security/adviso…	x_refsource_CONFIRM
https://github.com/getkirby/kirby/commit/22fbaedb…	x_refsource_MISC
https://github.com/getkirby/kirby/commit/a40808f5…	x_refsource_MISC
https://github.com/getkirby/kirby/commit/cd7abb68…	x_refsource_MISC
https://github.com/getkirby/kirby/commit/e0dca5f7…	x_refsource_MISC
https://github.com/getkirby/kirby/releases/tag/4.9.5	x_refsource_MISC
https://github.com/getkirby/kirby/releases/tag/5.5.2	x_refsource_MISC

Impacted products

1 product

Vendor	Product	Version	CPE status
getkirby	kirby	Affected: < 4.9.5 Affected: >= 5.0.0, < 5.5.2	guessed

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2026-75594",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2026-09-01T14:31:20.412958Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2026-09-01T14:31:42.348Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "kirby",
          "vendor": "getkirby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.9.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.5.2"
            }
          ]
        }
      ],
      "descriptions": [
        {
          "lang": "en",
          "value": "Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby\u0027s media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP\u0027s built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent\u0027s media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2."
        }
      ],
      "metrics": [
        {
          "cvssV4_0": {
            "attackComplexity": "LOW",
            "attackRequirements": "PRESENT",
            "attackVector": "NETWORK",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "privilegesRequired": "NONE",
            "subAvailabilityImpact": "NONE",
            "subConfidentialityImpact": "NONE",
            "subIntegrityImpact": "NONE",
            "userInteraction": "NONE",
            "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
            "version": "4.0",
            "vulnAvailabilityImpact": "NONE",
            "vulnConfidentialityImpact": "HIGH",
            "vulnIntegrityImpact": "NONE"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-22",
              "description": "CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2026-08-31T20:53:00.338Z",
        "orgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
        "shortName": "GitHub_M"
      },
      "references": [
        {
          "name": "https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w",
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w"
        },
        {
          "name": "https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9"
        },
        {
          "name": "https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20"
        },
        {
          "name": "https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e"
        },
        {
          "name": "https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c"
        },
        {
          "name": "https://github.com/getkirby/kirby/releases/tag/4.9.5",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkirby/kirby/releases/tag/4.9.5"
        },
        {
          "name": "https://github.com/getkirby/kirby/releases/tag/5.5.2",
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://github.com/getkirby/kirby/releases/tag/5.5.2"
        }
      ],
      "source": {
        "advisory": "GHSA-9vx2-j98c-p72w",
        "discovery": "UNKNOWN"
      },
      "title": "Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "a0819718-46f1-4df5-94e2-005712e83aaa",
    "assignerShortName": "GitHub_M",
    "cveId": "CVE-2026-75594",
    "datePublished": "2026-08-31T20:53:00.338Z",
    "dateReserved": "2026-08-17T23:49:03.449Z",
    "dateUpdated": "2026-09-01T14:31:42.348Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.2",
  "vulnerability-lookup:meta": {
    "epss": {
      "cve": "CVE-2026-75594",
      "date": "2026-09-01",
      "epss": "0.00513",
      "percentile": "0.41673"
    },
    "nvd": "{\"cve\":{\"id\":\"CVE-2026-75594\",\"sourceIdentifier\":\"security-advisories@github.com\",\"published\":\"2026-08-31T21:17:48.760\",\"lastModified\":\"2026-09-01T15:17:27.063\",\"vulnStatus\":\"Received\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby\u0027s media handler in src/Cms/Media.php allowed Kirby\\\\Cms\\\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP\u0027s built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent\u0027s media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.\"}],\"affected\":[{\"source\":\"security-advisories@github.com\",\"affectedData\":[{\"vendor\":\"getkirby\",\"product\":\"kirby\",\"versions\":[{\"version\":\"\u003c 4.9.5\",\"status\":\"affected\"},{\"version\":\"\u003e= 5.0.0, \u003c 5.5.2\",\"status\":\"affected\"}]}]}],\"metrics\":{\"cvssMetricV40\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"4.0\",\"vectorString\":\"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X\",\"baseScore\":8.2,\"baseSeverity\":\"HIGH\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"attackRequirements\":\"PRESENT\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"NONE\",\"vulnConfidentialityImpact\":\"HIGH\",\"vulnIntegrityImpact\":\"NONE\",\"vulnAvailabilityImpact\":\"NONE\",\"subConfidentialityImpact\":\"NONE\",\"subIntegrityImpact\":\"NONE\",\"subAvailabilityImpact\":\"NONE\",\"exploitMaturity\":\"NOT_DEFINED\",\"confidentialityRequirement\":\"NOT_DEFINED\",\"integrityRequirement\":\"NOT_DEFINED\",\"availabilityRequirement\":\"NOT_DEFINED\",\"modifiedAttackVector\":\"NOT_DEFINED\",\"modifiedAttackComplexity\":\"NOT_DEFINED\",\"modifiedAttackRequirements\":\"NOT_DEFINED\",\"modifiedPrivilegesRequired\":\"NOT_DEFINED\",\"modifiedUserInteraction\":\"NOT_DEFINED\",\"modifiedVulnConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedVulnIntegrityImpact\":\"NOT_DEFINED\",\"modifiedVulnAvailabilityImpact\":\"NOT_DEFINED\",\"modifiedSubConfidentialityImpact\":\"NOT_DEFINED\",\"modifiedSubIntegrityImpact\":\"NOT_DEFINED\",\"modifiedSubAvailabilityImpact\":\"NOT_DEFINED\",\"Safety\":\"NOT_DEFINED\",\"Automatable\":\"NOT_DEFINED\",\"Recovery\":\"NOT_DEFINED\",\"valueDensity\":\"NOT_DEFINED\",\"vulnerabilityResponseEffort\":\"NOT_DEFINED\",\"providerUrgency\":\"NOT_DEFINED\"}}],\"ssvcV203\":[{\"source\":\"134c704f-9b21-4f2e-91b3-4a467353bcc0\",\"ssvcData\":{\"timestamp\":\"2026-09-01T14:31:20.412958Z\",\"id\":\"CVE-2026-75594\",\"options\":[{\"exploitation\":\"none\"},{\"automatable\":\"no\"},{\"technicalImpact\":\"partial\"}],\"role\":\"CISA Coordinator\",\"version\":\"2.0.3\"}}]},\"weaknesses\":[{\"source\":\"security-advisories@github.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-22\"}]}],\"references\":[{\"url\":\"https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/getkirby/kirby/releases/tag/4.9.5\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/getkirby/kirby/releases/tag/5.5.2\",\"source\":\"security-advisories@github.com\"},{\"url\":\"https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w\",\"source\":\"security-advisories@github.com\"}]}}",
    "vulnrichment": {
      "containers": "{\"cna\": {\"title\": \"Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling\", \"problemTypes\": [{\"descriptions\": [{\"cweId\": \"CWE-22\", \"lang\": \"en\", \"description\": \"CWE-22: Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)\", \"type\": \"CWE\"}]}], \"metrics\": [{\"cvssV4_0\": {\"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"attackRequirements\": \"PRESENT\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"NONE\", \"vulnConfidentialityImpact\": \"HIGH\", \"vulnIntegrityImpact\": \"NONE\", \"vulnAvailabilityImpact\": \"NONE\", \"subConfidentialityImpact\": \"NONE\", \"subIntegrityImpact\": \"NONE\", \"subAvailabilityImpact\": \"NONE\", \"baseScore\": 8.2, \"baseSeverity\": \"HIGH\", \"vectorString\": \"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N\", \"version\": \"4.0\"}}], \"references\": [{\"name\": \"https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w\", \"tags\": [\"x_refsource_CONFIRM\"], \"url\": \"https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w\"}, {\"name\": \"https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9\"}, {\"name\": \"https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20\"}, {\"name\": \"https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e\"}, {\"name\": \"https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c\"}, {\"name\": \"https://github.com/getkirby/kirby/releases/tag/4.9.5\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/getkirby/kirby/releases/tag/4.9.5\"}, {\"name\": \"https://github.com/getkirby/kirby/releases/tag/5.5.2\", \"tags\": [\"x_refsource_MISC\"], \"url\": \"https://github.com/getkirby/kirby/releases/tag/5.5.2\"}], \"affected\": [{\"vendor\": \"getkirby\", \"product\": \"kirby\", \"versions\": [{\"version\": \"\u003c 4.9.5\", \"status\": \"affected\"}, {\"version\": \"\u003e= 5.0.0, \u003c 5.5.2\", \"status\": \"affected\"}]}], \"providerMetadata\": {\"orgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"shortName\": \"GitHub_M\", \"dateUpdated\": \"2026-08-31T20:53:00.338Z\"}, \"descriptions\": [{\"lang\": \"en\", \"value\": \"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby\u0027s media handler in src/Cms/Media.php allowed Kirby\\\\Cms\\\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP\u0027s built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent\u0027s media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.\"}], \"source\": {\"advisory\": \"GHSA-9vx2-j98c-p72w\", \"discovery\": \"UNKNOWN\"}}, \"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-75594\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"none\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-09-01T14:31:20.412958Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-09-01T14:31:27.921Z\"}}]}",
      "cveMetadata": "{\"cveId\": \"CVE-2026-75594\", \"assignerOrgId\": \"a0819718-46f1-4df5-94e2-005712e83aaa\", \"state\": \"PUBLISHED\", \"assignerShortName\": \"GitHub_M\", \"dateReserved\": \"2026-08-17T23:49:03.449Z\", \"datePublished\": \"2026-08-31T20:53:00.338Z\", \"dateUpdated\": \"2026-09-01T14:31:42.348Z\"}",
      "dataType": "CVE_RECORD",
      "dataVersion": "5.2"
    }
  }
}

FKIE_CVE-2026-75594

Vulnerability from fkie_nvd - Published: 2026-08-31 21:17 - Updated: 2026-09-01 15:17

Severity

8.2 (High) - CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Summary

References

	URL	Tags
	security-advisories@github.com	https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9
	security-advisories@github.com	https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20
	security-advisories@github.com	https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e
	security-advisories@github.com	https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c
	security-advisories@github.com	https://github.com/getkirby/kirby/releases/tag/4.9.5
	security-advisories@github.com	https://github.com/getkirby/kirby/releases/tag/5.5.2
	security-advisories@github.com	https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w

Impacted products

	Vendor	Product	Version

JSON

To clipboard

{
  "affected": [
    {
      "affectedData": [
        {
          "product": "kirby",
          "vendor": "getkirby",
          "versions": [
            {
              "status": "affected",
              "version": "\u003c 4.9.5"
            },
            {
              "status": "affected",
              "version": "\u003e= 5.0.0, \u003c 5.5.2"
            }
          ]
        }
      ],
      "source": "security-advisories@github.com"
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby\u0027s media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP\u0027s built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent\u0027s media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2."
    }
  ],
  "id": "CVE-2026-75594",
  "lastModified": "2026-09-01T15:17:27.063",
  "metrics": {
    "cvssMetricV40": [
      {
        "cvssData": {
          "Automatable": "NOT_DEFINED",
          "Recovery": "NOT_DEFINED",
          "Safety": "NOT_DEFINED",
          "attackComplexity": "LOW",
          "attackRequirements": "PRESENT",
          "attackVector": "NETWORK",
          "availabilityRequirement": "NOT_DEFINED",
          "baseScore": 8.2,
          "baseSeverity": "HIGH",
          "confidentialityRequirement": "NOT_DEFINED",
          "exploitMaturity": "NOT_DEFINED",
          "integrityRequirement": "NOT_DEFINED",
          "modifiedAttackComplexity": "NOT_DEFINED",
          "modifiedAttackRequirements": "NOT_DEFINED",
          "modifiedAttackVector": "NOT_DEFINED",
          "modifiedPrivilegesRequired": "NOT_DEFINED",
          "modifiedSubAvailabilityImpact": "NOT_DEFINED",
          "modifiedSubConfidentialityImpact": "NOT_DEFINED",
          "modifiedSubIntegrityImpact": "NOT_DEFINED",
          "modifiedUserInteraction": "NOT_DEFINED",
          "modifiedVulnAvailabilityImpact": "NOT_DEFINED",
          "modifiedVulnConfidentialityImpact": "NOT_DEFINED",
          "modifiedVulnIntegrityImpact": "NOT_DEFINED",
          "privilegesRequired": "NONE",
          "providerUrgency": "NOT_DEFINED",
          "subAvailabilityImpact": "NONE",
          "subConfidentialityImpact": "NONE",
          "subIntegrityImpact": "NONE",
          "userInteraction": "NONE",
          "valueDensity": "NOT_DEFINED",
          "vectorString": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X",
          "version": "4.0",
          "vulnAvailabilityImpact": "NONE",
          "vulnConfidentialityImpact": "HIGH",
          "vulnIntegrityImpact": "NONE",
          "vulnerabilityResponseEffort": "NOT_DEFINED"
        },
        "source": "security-advisories@github.com",
        "type": "Secondary"
      }
    ],
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2026-75594",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "role": "CISA Coordinator",
          "timestamp": "2026-09-01T14:31:20.412958Z",
          "version": "2.0.3"
        }
      }
    ]
  },
  "published": "2026-08-31T21:17:48.760",
  "references": [
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/releases/tag/4.9.5"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/releases/tag/5.5.2"
    },
    {
      "source": "security-advisories@github.com",
      "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w"
    }
  ],
  "sourceIdentifier": "security-advisories@github.com",
  "vulnStatus": "Received",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ],
      "source": "security-advisories@github.com",
      "type": "Secondary"
    }
  ]
}

GHSA-9VX2-J98C-P72W

Vulnerability from github – Published: 2026-08-31 22:12 – Updated: 2026-08-31 22:12

Summary

Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling

Details

TL;DR

This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (%2f), such as nginx, PHP's built-in server or Apache setups that have the option AllowEncodedSlashes enabled.

It was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the .json file extension anywhere on the server.

This vulnerability is of high severity for affected sites.

Server setups using Apache's default configuration or other servers that have been hardened against encoded slashes in URLs are not affected.

Introduction

A path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as ../, an attacker can escape that directory and reach files elsewhere on the server.

Affected components

Kirby's media handler processes requests for files in the media directory that have not been generated yet. It parses the provided path and finds the correct file or asset from which to generate a thumbnail. Each thumbnail needs to have a prepared job file (a metadata file with file extension .json) in order to allow the media handler to generate it.

Each parent (such as a page) has its own media directory, which in turn contains the individual files. Kirby's media handler searches for the file within the parent's media directory.

Impact

In affected releases, Kirby did not prevent path traversal in the filenames that were searched within the parent directory. In affected server setups where the attacker can provide encoded slashes (%2f) in the request, Kirby allowed the request to traverse away from the parent's media directory.

Because the response differs between existing and non-existing thumbnail configurations, attackers were able to tell whether an arbitrary JSON file exists on the server (addressed by a relative path from the media directory of an arbitrary existing parent, including a relative path that points outside of the site's index root). For existing files with the file extension .json and a valid filename key (resulting in a valid job file), it was possible to generate thumbnails of the referenced media files, deleting the job file in the process.

Patches

The problem has been patched in Kirby 4.9.5 and Kirby 5.5.2. Please update to one of these or a later version to fix the vulnerability.

In all of the mentioned releases, Kirby\Cms\Media::thumb() now rejects any filename that contains path information (anything other than a plain filename) before it is appended to the validated root. We have also hardened the file::version component to block paths that contain the ../ sequence.

Credits

Thanks to Jorge González Milla (@Pig-Tail) for responsibly reporting the identified issue.

Severity

8.2 (High)


                  
                    CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Show details on source website

JSON

To clipboard

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.9.4"
      },
      "package": {
        "ecosystem": "Packagist",
        "name": "getkirby/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "0"
            },
            {
              "fixed": "4.9.5"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "package": {
        "ecosystem": "Packagist",
        "name": "getkirby/cms"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.5.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2026-75594"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-08-31T22:12:45Z",
    "nvd_published_at": "2026-08-31T21:17:48Z",
    "severity": "HIGH"
  },
  "details": "### TL;DR\n\nThis vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (`%2f`), such as nginx, PHP\u0027s built-in server or Apache setups that have the option `AllowEncodedSlashes` enabled.\n \nIt was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the `.json` file extension anywhere on the server.\n \n**This vulnerability is of high severity for affected sites.**\n \nServer setups using Apache\u0027s default configuration or other servers that have been hardened against encoded slashes in URLs are *not* affected.\n\n----\n\n### Introduction\n\nA path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as `../`, an attacker can escape that directory and reach files elsewhere on the server.\n\n### Affected components\n\nKirby\u0027s media handler processes requests for files in the `media` directory that have not been generated yet. It parses the provided path and finds the correct file or asset from which to generate a thumbnail. Each thumbnail needs to have a prepared job file (a metadata file with file extension `.json`) in order to allow the media handler to generate it.\n \nEach parent (such as a page) has its own media directory, which in turn contains the individual files. Kirby\u0027s media handler searches for the file within the parent\u0027s media directory.\n\n### Impact\n\nIn affected releases, Kirby did not prevent path traversal in the filenames that were searched within the parent directory. In affected server setups where the attacker can provide encoded slashes (`%2f`) in the request, Kirby allowed the request to traverse away from the parent\u0027s media directory.\n \nBecause the response differs between existing and non-existing thumbnail configurations, attackers were able to tell whether an arbitrary JSON file exists on the server (addressed by a relative path from the media directory of an arbitrary existing parent, including a relative path that points outside of the site\u0027s `index` root). For existing files with the file extension `.json` and a valid `filename` key (resulting in a valid job file), it was possible to generate thumbnails of the referenced media files, deleting the job file in the process.\n \n### Patches\n\nThe problem has been patched in [Kirby 4.9.5](https://github.com/getkirby/kirby/releases/tag/4.9.5) and [Kirby 5.5.2](https://github.com/getkirby/kirby/releases/tag/5.5.2). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn all of the mentioned releases, `Kirby\\Cms\\Media::thumb()` now rejects any filename that contains path information (anything other than a plain filename) before it is appended to the validated root. We have also hardened the `file::version` component to block paths that contain the `../` sequence.\n\n### Credits\n\nThanks to Jorge Gonz\u00e1lez Milla (@Pig-Tail) for responsibly reporting the identified issue.",
  "id": "GHSA-9vx2-j98c-p72w",
  "modified": "2026-08-31T22:12:45Z",
  "published": "2026-08-31T22:12:45Z",
  "references": [
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w"
    },
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-75594"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c"
    },
    {
      "type": "PACKAGE",
      "url": "https://github.com/getkirby/kirby"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/releases/tag/4.9.5"
    },
    {
      "type": "WEB",
      "url": "https://github.com/getkirby/kirby/releases/tag/5.5.2"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N",
      "type": "CVSS_V4"
    }
  ],
  "summary": "Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

The MITRE ATT&CK techniques below are AI-generated suggestions, inferred from the description of the vulnerability by the CIRCL/vulnerability-attack-technique-classification-roberta-base model, served locally by ML-Gateway. They have not been verified by an analyst and are provided for guidance only.
The approach is described in our paper Mapping CVEs to MITRE ATT&CK Techniques: A Curated Gold-Set Classifier and the Limits of LLM-Assisted Label Expansion.

Action not permitted

CVE-2026-75594 (GCVE-0-2026-75594)

FKIE_CVE-2026-75594

GHSA-9VX2-J98C-P72W

TL;DR

Introduction

Affected components

Impact

Patches

Credits

Tags

Sightings

Nomenclature