Unrestricted File Upload Vulnerability in Kirby CMS
Summary
CVE-2024-26483: Kirby vulnerable to unrestricted file upload of user avatar images. Affects getkirby/cms across 6 version ranges.
< 3.6.6.5
>= 3.7.0, < 3.7.5.4
>= 3.8.0, < 3.8.4.3
>= 3.9.0, < 3.9.8.1
>= 3.10.0, < 3.10.0.1
>= 4.0.0, < 4.1.1
Fixed in 6 releases; the minimum fixed version depends on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby CMS is an open-source content management system that allows users to create and manage websites. It provides a user-friendly interface for managing content, including the ability to upload user avatars. However, a vulnerability in Kirby CMS allows authenticated Panel users to upload files with dangerous types, potentially leading to security risks.
Vulnerability Detail
The vulnerability in Kirby CMS allows authenticated Panel users to upload user avatars without proper validation of the file type or extension. While the upload is protected against dangerous file types like HTML or PHP files, it can still be abused to upload unexpected files such as PDFs. These files can then be accessed via direct links, potentially exposing sensitive information or enabling cross-site scripting attacks.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.6.6.53.6.6.5composer require getkirby/cms:3.6.6.5 -
>= 3.7.0, < 3.7.5.43.7.5.4composer require getkirby/cms:3.7.5.4 -
>= 3.8.0, < 3.8.4.33.8.4.3composer require getkirby/cms:3.8.4.3 -
>= 3.9.0, < 3.9.8.13.9.8.1composer require getkirby/cms:3.9.8.1 -
>= 3.10.0, < 3.10.0.13.10.0.1composer require getkirby/cms:3.10.0.1 -
>= 4.0.0, < 4.1.14.1.1composer require getkirby/cms:4.1.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to update to the patched versions mentioned above to mitigate the risk.
Conclusion
The unrestricted file upload vulnerability in Kirby CMS can be mitigated by updating to the patched versions. It is crucial to keep the CMS up to date to ensure the security of user avatars and prevent potential security risks. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for getkirby/cms →
FAQ
The vulnerability allows authenticated Panel users to upload unexpected files, potentially leading to security risks such as exposure of sensitive information or cross-site scripting attacks.
No, this vulnerability requires user interaction by another user or visitor and cannot be automated.
No, only versions up to 3.6.6.4, 3.7.5.3, 3.8.4.2, 3.9.8, and 4.1.0 are affected. Updating to the patched versions mentioned above will fix the vulnerability.
No, this vulnerability does not allow remote code execution. However, it can be abused to upload unexpected files that could enable other types of attacks.
The vulnerability was responsibly reported by Natwara Archeepsamooth (@PlyNatwara).
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
