CVE-2025-30159: Kirby Path Traversal Vulnerability in Snippet Helper
Summary
CVE-2025-30159: Kirby vulnerable to path traversal of snippet names in the snippet() helper. Affects getkirby/kirby across 3 version ranges.
< 3.9.8.3
>= 3.10.0, < 3.10.1.2
>= 4.0.0, < 4.7.1
Fixed in 3.9.8.3, 3.10.1.2 or 4.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby is a flexible content management system that allows users to create and manage websites using a file-based approach. It provides a simple way to load PHP snippet files through its snippet() helper, which is designed to enhance modularity and reusability of code. However, a vulnerability exists in this helper when dynamic snippet names are used, allowing potential attackers to exploit the system.
Vulnerability Detail
The vulnerability arises from the lack of proper path traversal checks in Kirby's snippet() helper. When called with a dynamic snippet name, the helper does not validate the path, allowing attackers to use special sequences like '../' to navigate outside the designated snippets directory. This could lead to unauthorized access to sensitive files on the server, execution of arbitrary PHP code, and compromise of the server's confidentiality and integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.8.33.9.8.3composer require getkirby/kirby:3.9.8.3 -
>= 3.10.0, < 3.10.1.23.10.1.2composer require getkirby/kirby:3.10.1.2 -
>= 4.0.0, < 4.7.14.7.1composer require getkirby/kirby:4.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If you have deliberately used path traversal in your projects, these uses will break after updating to a patched version. Instead of using path traversal, consider using the following robust alternatives:
- For aliasing a template, use:
require __DIR__ . '/other-template.php'; - To override the template method in the page model, implement:
class AnotherPage extends Page { public function template(): Template { return $this->kirby()->template('other-template'); } } - Restructure your project to have a shared snippets root for multisite setups, or use symbolic links to include shared directories.
Conclusion
The path traversal vulnerability in Kirby's snippet() helper poses significant risks to server security. It is crucial for developers using Kirby to update to the latest patched versions and to implement safer coding practices to prevent exploitation. Utilizing tools like Vulert can help in monitoring and managing vulnerabilities effectively.
See every vulnerability recorded for getkirby/kirby →
FAQ
The vulnerability allows attackers to access and execute arbitrary files on the server, potentially leading to data breaches and server compromise.
You can use Vulert, which monitors open-source vulnerabilities in real-time. Visit Vulert Scanner to check your application without needing to sign up.
All versions of Kirby that use the snippet() helper with dynamic snippet names are affected. Ensure you update to at least version 3.9.8.3, 3.10.1.2, or 4.7.1.
If immediate updating is not possible, review your code for any dynamic snippet calls and replace them with safer alternatives to mitigate the risk.
The vulnerability was reported by Bruno Meilick, with contributions from Tobias Möritz regarding its effects on site code.
References
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/kirby.
