CVE-2025-31493: Kirby CMS Path Traversal Vulnerability in Collection Helper
Summary
CVE-2025-31493: Kirby vulnerable to path traversal of collection names during file system lookup. Affects getkirby/cms across 3 version ranges.
< 3.9.8.3
>= 3.10.0, < 3.10.1.2
>= 4.0.0, < 4.7.1
Fixed in 3.9.8.3, 3.10.1.2 or 4.7.1, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby is a flexible content management system (CMS) that allows developers to create websites using a file-based approach. It provides a simple and intuitive interface for managing content and supports various plugins to extend its functionality. However, a vulnerability has been identified in the collection() helper method, which can lead to unauthorized access to files on the server due to improper handling of dynamic collection names.
Vulnerability Detail
The vulnerability arises from the collection() helper in Kirby, which allows loading PHP logic files from the site/collections directory. When called with a dynamic collection name, the method does not adequately validate the input, allowing attackers to exploit path traversal techniques. By using sequences like '../', an attacker can navigate outside the intended directory, potentially accessing sensitive files on the server. This could lead to unauthorized file access, execution of malicious scripts, and compromise of server integrity.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 3.9.8.33.9.8.3composer require getkirby/cms:3.9.8.3 -
>= 3.10.0, < 3.10.1.23.10.1.2composer require getkirby/cms:3.10.1.2 -
>= 4.0.0, < 4.7.14.7.1composer require getkirby/cms:4.7.1
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, avoid using dynamic collection names in the collection() helper. Instead, use fixed collection names that do not depend on user input or request data. For example, replace collection('tags-' . get('tags')) with a static collection name like collection('tags-default').
Conclusion
The CVE-2025-31493 vulnerability in Kirby CMS poses a significant risk due to improper handling of dynamic collection names, allowing for path traversal attacks. It is crucial to update to the patched versions to mitigate this risk and ensure the security of your application.
See every vulnerability recorded for getkirby/cms →
FAQ
The vulnerability allows attackers to access arbitrary files on the server, potentially leading to data leakage, unauthorized access to sensitive information, and execution of malicious code.
If your site uses the collection() helper with dynamic collection names, it may be vulnerable. Check your code for such instances and update to a patched version.
The patched versions are Kirby 3.9.8.3, 3.10.1.2, and 4.7.1. Updating to any of these versions will resolve the vulnerability.
Yes, Vulert can monitor your project for open-source vulnerabilities using the composer.lock file. You can check if your application is affected by this vulnerability using the Vulert playground.
If an immediate update is not possible, implement the suggested workaround by avoiding dynamic collection names in your code until you can apply the patch.
References
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
