CVE-2020-26255
PHP Phar archives could be uploaded and executed in Kirby
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access cannot use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
PHP Phar archives could be uploaded and executed in Kirby
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access cannot use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
- Record
CVE-2020-26255- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
EUVDEUVD-2020-1494
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access cannot use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
- Record
EUVD-2020-1494- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-g3h8-cg9x-47qw
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5
Impact
An editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file.
Visitors without Panel access cannot use this attack vector.
Patches
The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability.
Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
Workarounds
Kirby 2 sites on older releases can also be patched by applying the changes from this commit.
Credits
Thanks to Thore Imhof of Accenture for reporting the problem.
- Record
GHSA-g3h8-cg9x-47qw- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
NVD
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access cannot use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
- Record
CVE-2020-26255- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N - CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - CVSS 2.0
- 6.5 Medium
AV:N/AC:L/Au:S/C:P/I:P/A:P - Weakness
- CWE-434
- Updated
- 2026-11-02
OSV
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access cannot use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
- Record
CVE-2020-26255- CVSS 3.1
- 9.1 Critical
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H - Updated
- 2026-11-02
OSVGHSA-g3h8-cg9x-47qw
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5
Impact
An editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file.
Visitors without Panel access cannot use this attack vector.
Patches
The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability.
Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
Workarounds
Kirby 2 sites on older releases can also be patched by applying the changes from this commit.
Credits
Thanks to Thore Imhof of Accenture for reporting the problem.
- Record
GHSA-g3h8-cg9x-47qw- CVSS 3.1
- 6.8 Medium
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N - Weakness
- CWE-434
- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
getkirby/panelPackagist |
before 2.5.14 | 2.5.14 |
getkirby/cmsPackagist |
3.0.0 up to 3.4.5 | 3.4.5 |
getkirby/panelPackagist |
before 2.5.14, plus listed versions 2.4.02.4.12.4.22.5.02.5.1 Show 19 moreShow less2.5.102.5.112.5.11-RC-12.5.122.5.132.5.22.5.32.5.42.5.52.5.5-RC-12.5.62.5.6-RC-12.5.72.5.7-RC-12.5.82.5.8-RC-12.5.92.5.9-RC-12.5.9-RC-2 |
2.5.14 |
getkirby/cmsPackagist |
3.0.0 up to 3.4.5, plus listed versions 3.0.13.0.1-rc.13.0.23.0.2-rc.13.0.3 Show 45 moreShow less3.0.3-rc.13.0.3-rc.23.0.3-rc.33.1.03.1.0-rc.13.1.13.1.23.1.2-rc.13.1.33.1.3-rc.13.1.43.1.4-rc.13.2.03.2.0-rc.13.2.0-rc.23.2.0-rc.33.2.0-rc.43.2.13.2.1-rc.13.2.23.2.33.2.3-rc.13.2.43.2.4-rc.13.2.53.2.5-rc.13.2.5-rc.23.3.03.3.0-rc.13.3.0-rc.23.3.0-rc.33.3.0-rc.43.3.0-rc.53.3.13.3.1-rc.13.3.23.3.2-rc.13.3.33.3.3-rc.13.3.43.3.4-rc.13.3.53.3.5-rc.13.3.63.4.0 |
3.4.5 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2020-26255 is a medium vulnerability (CVSS 6.8) in Getkirby Kirby, published December 8, 2020. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.49%, the 74th percentile. Fixed in getkirby/panel 2.5.14.
References
packagist.org/packages/getkirby/cms
github.com/getkirby/kirby/security/advisories/GHSA-g3h8-cg9x-47qw
nvd.nist.gov/vuln/detail/CVE-2020-26255
Left out here: 10 versions. The JSON record has them.