CVE-2026-75594: Kirby CMS Path Traversal Vulnerability in Media Handling
Summary
CVE-2026-75594: TL;DR This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (%2f), such as nginx, PHP's built-in server or Apache setups that have the option AllowEnc... Affects getkirby/cms across 2 version ranges.
< 4.9.5
>= 5.0.0, < 5.5.2
Fixed in 4.9.5 or 5.5.2, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Kirby is a flexible and user-friendly content management system (CMS) that allows developers to create custom websites with ease. It is known for its simplicity and the ability to manage content without a database. However, a recent vulnerability has been discovered in its media handling component, which could allow unauthorized access to files on the server.
Vulnerability Detail
The vulnerability arises from a path traversal issue in Kirby's media handler, which processes requests for media files. When deployed on servers that allow encoded slashes in URLs, such as nginx or Apache with 'AllowEncodedSlashes' enabled, attackers can exploit this flaw. By injecting encoded slashes (%2f), they can traverse outside the intended media directory, potentially accessing sensitive JSON files and generating thumbnails from arbitrary media files. This could lead to unauthorized file access and manipulation, making it a high-severity vulnerability.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
< 4.9.54.9.5composer require getkirby/cms:4.9.5 -
>= 5.0.0, < 5.5.25.5.2composer require getkirby/cms:5.5.2
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, ensure that your server configuration does not allow encoded slashes in URLs. For Apache, you can disable this feature by setting 'AllowEncodedSlashes Off' in your configuration file.
Conclusion
The CVE-2026-75594 vulnerability in Kirby CMS poses a significant risk to sites deployed on certain server configurations. It is crucial to update to the patched versions to mitigate the risk of unauthorized file access and ensure the security of your application.
See every vulnerability recorded for getkirby/cms →
FAQ
The CVSS score of this vulnerability is 8.2, indicating a high severity level.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
If left unpatched, attackers could exploit this vulnerability to access sensitive files on your server, leading to data breaches or unauthorized file manipulation.
If your server is configured with Apache's default settings or has been hardened against encoded slashes, it is not affected by this vulnerability.
The vulnerability was responsibly reported by Jorge González Milla (@Pig-Tail).
References
Related vulnerabilities
Recent vulnerabilities recorded for getkirby/cms.
