CVE-2025-30207: Kirby CMS Path Traversal Vulnerability in PHP Built-in Server
Summary
CVE-2025-30207: Kirby vulnerable to path traversal in the router for PHP's built-in server. Affects getkirby/cms across 3 version ranges.
< 3.9.8.3
>= 3.10.0, < 3.10.1.2
>= 4.0.0, < 4.7.1
Fixed in 3.9.8.3, 3.10.1.2 or 4.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby is a flexible and user-friendly content management system (CMS) that allows developers to create websites with ease. It is designed to be simple and intuitive, making it a popular choice for developers who prefer a file-based approach to content management. However, when using PHP's built-in server, a vulnerability was discovered that allows attackers to exploit path traversal issues, potentially accessing sensitive files outside the intended directory structure.
Vulnerability Detail
The vulnerability arises from the router.php file used by Kirby with PHP's built-in web server. This file is responsible for delegating requests to static files, but it lacks proper checks against path traversal attacks. By using sequences like '../', attackers can navigate outside the document root and access files on the server that should be restricted. Although the contents of these files are not exposed due to PHP's handling of invalid requests, the ability to determine the existence of files poses a security risk.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.8.33.9.8.3composer require getkirby/cms:3.9.8.3 -
>= 3.10.0, < 3.10.1.23.10.1.2composer require getkirby/cms:3.10.1.2 -
>= 4.0.0, < 4.7.14.7.1composer require getkirby/cms:4.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using PHP's built-in server for production environments. Instead, deploy your Kirby application on a more secure server setup, such as Apache, nginx, or Caddy, which are not affected by this vulnerability.
Conclusion
The path traversal vulnerability in Kirby when using PHP's built-in server poses a significant risk to applications. It is crucial for developers to update to the patched versions to safeguard their installations. Utilizing Vulert can help monitor and alert for such vulnerabilities in real-time, ensuring ongoing security.
See every vulnerability recorded for getkirby/cms →
FAQ
The vulnerability is a path traversal issue that allows attackers to access files outside the intended directory structure when using PHP's built-in server.
All Kirby setups using PHP's built-in server for local development are affected. Those using other server software are not impacted.
Attackers may determine the existence of files on the server, which could lead to further exploitation or information disclosure.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
The best mitigation is to avoid using PHP's built-in server for production. Use a more secure server environment instead.
References
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
