CVE-2026-75592: Kirby CMS Path Traversal Vulnerability in Media Handling
Summary
CVE-2026-75592: Kirby: Access to image files outside of the site root via path traversal in the media handling. Affects getkirby/cms across 2 version ranges.
< 4.9.5
>= 5.0.0, < 5.5.2
Fixed in 4.9.5 or 5.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby is a flexible content management system (CMS) that allows users to create and manage websites with ease. It is known for its simplicity and file-based architecture, which enables developers to build custom solutions without a database. However, the recent vulnerability identified as CVE-2026-75592 exposes Kirby sites to potential security risks due to improper containment checks in its media handling functionality.
Vulnerability Detail
The vulnerability arises from a path traversal issue in Kirby's media handler, which processes requests for media files. When the index root of a Kirby site is located next to another directory with a similar name prefix, attackers can exploit incomplete containment checks to access sensitive media files stored in sibling directories. This could lead to information leaks or unauthorized deletion of job files, posing a significant risk to the integrity and confidentiality of the site's data.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.9.54.9.5composer require getkirby/cms:4.9.5 -
>= 5.0.0, < 5.5.25.5.2composer require getkirby/cms:5.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your Kirby site's index root is not placed next to any other directories that share the same name prefix. This can help mitigate the risk of exploitation until the site is updated to a patched version.
Conclusion
The CVE-2026-75592 vulnerability in Kirby CMS highlights the importance of maintaining proper containment checks in media handling functionalities. Users are encouraged to update to the latest patched versions to safeguard their sites against potential exploitation.
See every vulnerability recorded for getkirby/cms →
FAQ
CVE-2026-75592 is a path traversal vulnerability in Kirby CMS that allows unauthorized access to media files outside of the site root.
If your Kirby site has its index root next to another directory with a similar name prefix and is running a vulnerable version, it is at risk. You can check your application's vulnerability status using Vulert's playground.
Exploitation of this vulnerability can lead to unauthorized access to sensitive media files and potential data leaks or deletion of job files.
You can update your Kirby installation by running composer update getkirby/cms in your terminal to ensure you are using a patched version.
Yes, you can use Vulert to monitor and alert for open-source vulnerabilities in your software without needing access to the code or installation.
References
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
