{"id":"CVE-2026-29905","aliases":["EUVD-2026-16232","GHSA-cw7v-45wm-mcf2"],"status":"published","title":"Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload","description":"Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.","severity":{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp","from":"cve"},"epss":{"day":"2026-11-12","score":0.00473,"percentile":0.41375,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":false},"cwes":["CWE-20","CWE-252"],"published":"2026-03-26T00:00:00Z","modified":"2026-10-28T02:30:28Z","products":[{"vendor":"getkirby","product":"kirby"}],"references":[{"url":"https://github.com/getkirby/kirby/releases/tag/5.2.0-rc.1","tags":["Product","web"]},{"url":"https://drive.google.com/file/d/1MwvvSYIwnC8kOIzjycGMQZw4d2K2ef8h/view?usp=sharing","tags":["Exploit","web"]},{"url":"https://github.com/Stalin-143/CVE-2026-29905","tags":["Third Party Advisory","package"]},{"url":"https://github.com/Stalin-143/CVE-2026-29905/security/advisories/GHSA-cw7v-45wm-mcf2","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-29905","tags":["advisory"]},{"url":"https://github.com/github/advisory-database/pull/7503","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cw7v-45wm-mcf2"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/29xxx/CVE-2026-29905.json","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-29905","description":"Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.","status":"published","published":"2026-03-26T00:00:00Z","modified":"2026-03-26T18:31:41.421Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"adp"}],"cwes":["CWE-252","CWE-20"],"updated_at":"2026-11-02T14:19:56.284359Z"}],"euvd":[{"id":"EUVD-2026-16232","description":"Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.","status":"published","published":"2026-03-26T00:00:00Z","modified":"2026-03-26T18:31:41Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T19:25:28.18595Z"}],"ghsa":[{"id":"GHSA-cw7v-45wm-mcf2","title":"Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is been determined to not be a vulnerability. This link is maintained to preserve external references.\n\n### Original Description\n\n## Summary\n\nKirby CMS through version 5.1.4 allows an authenticated user with Editor permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.\n\n## Details\n\nThe vulnerability is caused by improper validation of the return value of PHP's `getimagesize()` function. When a malformed file is uploaded with a valid image extension (e.g., `.jpg`), the function returns `false` instead of an expected array.\n\nThe application fails to handle this condition properly and proceeds with image processing, resulting in a fatal `TypeError`. This leads to persistent application crashes when the affected file is accessed.\n\n## Impact\n\n- Persistent Denial of Service (DoS)\n- Affected pages return HTTP 500 errors\n- Requires manual removal of the malformed file to restore functionality\n- Exploitable by authenticated users with Editor permissions\n\n\n## Identifiers\n- CVE-2026-29905\n\n## Resources\n\n- https://github.com/github/advisory-database/pull/7503\n- https://github.com/Stalin-143/CVE-2026-29905\n- https://github.com/getkirby/kirby/releases/tag/5.2.0-rc.1\n- https://www.cve.org/CVERecord?id=CVE-2026-29905","status":"withdrawn","published":"2026-03-27T22:21:26Z","modified":"2026-04-30T18:33:04Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20","CWE-252"],"updated_at":"2026-11-02T14:39:59.776263Z"}],"nvd":[{"id":"CVE-2026-29905","description":"Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.","status":"published","published":"2026-03-26T17:16:34.66Z","modified":"2026-06-17T10:29:55.9Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium","assessor":"secondary"}],"cwes":["CWE-20","CWE-252"],"updated_at":"2026-11-02T14:12:11.678711Z"}],"osv":[{"id":"CVE-2026-29905","description":"Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.","status":"published","published":"2026-03-26T00:00:00Z","modified":"2026-10-28T02:30:28.751267911Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"updated_at":"2026-11-02T15:45:00.530889Z"},{"id":"GHSA-cw7v-45wm-mcf2","title":"Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload","description":"### Duplicate Advisory\nThis advisory has been withdrawn because it is been determined to not be a vulnerability. This link is maintained to preserve external references.\n\n### Original Description\n\n## Summary\n\nKirby CMS through version 5.1.4 allows an authenticated user with Editor permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.\n\n## Details\n\nThe vulnerability is caused by improper validation of the return value of PHP's `getimagesize()` function. When a malformed file is uploaded with a valid image extension (e.g., `.jpg`), the function returns `false` instead of an expected array.\n\nThe application fails to handle this condition properly and proceeds with image processing, resulting in a fatal `TypeError`. This leads to persistent application crashes when the affected file is accessed.\n\n## Impact\n\n- Persistent Denial of Service (DoS)\n- Affected pages return HTTP 500 errors\n- Requires manual removal of the malformed file to restore functionality\n- Exploitable by authenticated users with Editor permissions\n\n\n## Identifiers\n- CVE-2026-29905\n\n## Resources\n\n- https://github.com/github/advisory-database/pull/7503\n- https://github.com/Stalin-143/CVE-2026-29905\n- https://github.com/getkirby/kirby/releases/tag/5.2.0-rc.1\n- https://www.cve.org/CVERecord?id=CVE-2026-29905","status":"withdrawn","published":"2026-03-27T22:21:26Z","modified":"2026-09-10T03:50:38.665008208Z","cvss":[{"version":"3.1","score":6.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H","level":"medium"}],"cwes":["CWE-20","CWE-252"],"updated_at":"2026-11-02T15:46:45.639885Z"}]}}