{"id":"CVE-2026-75594","aliases":["EUVD-2026-68813","GHSA-9vx2-j98c-p72w"],"status":"published","title":"Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling","description":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.","severity":{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-11","score":0.00762,"percentile":0.5578,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-22"],"published":"2026-08-31T20:53:00Z","modified":"2026-11-04T02:47:51Z","fixes":[{"ecosystem":"Packagist","package":"getkirby/cms","fixed_in":["4.9.5","5.5.2"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Packagist","package":"getkirby/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"4.9.4"},{"fixed":"4.9.5"}]}]},{"source":"ghsa","ecosystem":"Packagist","package":"getkirby/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.5.2"}]}]},{"source":"osv","ecosystem":"Packagist","package":"getkirby/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.9.5"}]}],"versions":["3.0.0","3.0.1","3.0.1-rc.1","3.0.2","3.0.2-rc.1","3.0.3","3.0.3-rc.1","3.0.3-rc.2","3.0.3-rc.3","3.1.0","3.1.0-rc.1","3.1.1","3.1.2","3.1.2-rc.1","3.1.3","3.1.3-rc.1","3.1.4","3.1.4-rc.1","3.10.0","3.10.0.1","3.10.1","3.10.1.1","3.10.1.2","3.2.0","3.2.0-rc.1","3.2.0-rc.2","3.2.0-rc.3","3.2.0-rc.4","3.2.1","3.2.1-rc.1","3.2.2","3.2.3","3.2.3-rc.1","3.2.4","3.2.4-rc.1","3.2.5","3.2.5-rc.1","3.2.5-rc.2","3.3.0","3.3.0-rc.1","3.3.0-rc.2","3.3.0-rc.3","3.3.0-rc.4","3.3.0-rc.5","3.3.1","3.3.1-rc.1","3.3.2","3.3.2-rc.1","3.3.3","3.3.3-rc.1","3.3.4","3.3.4-rc.1","3.3.5","3.3.5-rc.1","3.3.6","3.4.0","3.4.0-rc.1","3.4.0-rc.2","3.4.0-rc.3","3.4.1","3.4.1-rc.1","3.4.2","3.4.3","3.4.3-rc.1","3.4.4","3.4.4-rc.1","3.4.5","3.5.0","3.5.0-rc.1","3.5.0-rc.2","3.5.0-rc.3","3.5.0-rc.4","3.5.0-rc.5","3.5.0-rc.6","3.5.0-rc.7","3.5.1","3.5.1-rc.1","3.5.2","3.5.2-rc.1","3.5.3","3.5.3.1","3.5.4","3.5.5","3.5.5-rc.1","3.5.6","3.5.6-rc.1","3.5.7","3.5.7-rc.1","3.5.7.1","3.5.8","3.5.8.1","3.5.8.2","3.5.8.3","3.5.8.4","3.6.0","3.6.0-alpha.1","3.6.0-alpha.2","3.6.0-alpha.3","3.6.0-alpha.4","3.6.0-beta.1","3.6.0-beta.2","3.6.0-beta.3","3.6.0-rc.1","3.6.0-rc.2","3.6.0-rc.3","3.6.0-rc.4","3.6.0-rc.5","3.6.1","3.6.1.1","3.6.2","3.6.2-rc.1","3.6.2-rc.2","3.6.2-rc.3","3.6.3","3.6.3-rc.1","3.6.3-rc.2","3.6.3.1","3.6.4","3.6.4-rc.1","3.6.5","3.6.5-rc.1","3.6.6","3.6.6-rc.1","3.6.6.1","3.6.6.2","3.6.6.3","3.6.6.4","3.6.6.5","3.6.6.6","3.7.0","3.7.0-rc.1","3.7.0-rc.2","3.7.0-rc.3","3.7.0.1","3.7.0.2","3.7.1","3.7.1-rc.1","3.7.2","3.7.2-rc.1","3.7.2.1","3.7.3","3.7.3-rc.1","3.7.4","3.7.4-rc.1","3.7.5","3.7.5.1","3.7.5.2","3.7.5.3","3.7.5.4","3.7.5.5","3.8.0","3.8.0-rc.1","3.8.0-rc.2","3.8.0-rc.3","3.8.1","3.8.1-rc.1","3.8.1.1","3.8.2","3.8.2-rc.1","3.8.3","3.8.3-rc.1","3.8.3-rc.2","3.8.4","3.8.4.1","3.8.4.2","3.8.4.3","3.8.4.4","3.9.0","3.9.0-rc.1","3.9.0-rc.2","3.9.1","3.9.1-rc.1","3.9.2","3.9.2-rc.1","3.9.3","3.9.3-rc.1","3.9.4","3.9.4-rc.1","3.9.5","3.9.5-rc.1","3.9.6","3.9.6-rc.1","3.9.6.1","3.9.7","3.9.7-rc.1","3.9.8","3.9.8-rc.1","3.9.8.1","3.9.8.2","3.9.8.3","4.0.0","4.0.0-alpha.1","4.0.0-alpha.2","4.0.0-alpha.3","4.0.0-alpha.4","4.0.0-alpha.5","4.0.0-alpha.6","4.0.0-alpha.7","4.0.0-beta.1","4.0.0-beta.2","4.0.0-beta.3","4.0.0-rc.1","4.0.0-rc.2","4.0.0-rc.3","4.0.0-rc.4","4.0.1","4.0.2","4.0.3","4.1.0","4.1.0-rc.1","4.1.0-rc.2","4.1.0-rc.3","4.1.1","4.1.2","4.2.0","4.2.0-rc.1","4.3.0","4.3.0-rc.1","4.3.1","4.4.0","4.4.0-rc.1","4.4.1","4.5.0","4.5.0-rc.1","4.6.0","4.6.0-rc.1","4.6.1","4.7.0","4.7.0-rc.1","4.7.1","4.7.2","4.8.0","4.8.0-rc.1","4.9.0","4.9.1","4.9.2","4.9.3","4.9.4"]},{"source":"osv","ecosystem":"Packagist","package":"getkirby/cms","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.0.0"},{"fixed":"5.5.2"}]}],"versions":["5.0.0","5.0.1","5.0.2","5.0.3","5.0.4","5.1.0","5.1.0-rc.1","5.1.1","5.1.2","5.1.3","5.1.4","5.2.0","5.2.0-rc.1","5.2.1","5.2.2","5.2.3","5.3.0","5.3.0-rc.1","5.3.1","5.3.2","5.3.3","5.4.0","5.4.1","5.4.2","5.4.3","5.4.4","5.5.0","5.5.1"]}],"products":[{"vendor":"getkirby","product":"kirby"}],"references":[{"url":"https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w","tags":["x_refsource_CONFIRM","advisory","web"]},{"url":"https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c","tags":["x_refsource_MISC","fix","web"]},{"url":"https://github.com/getkirby/kirby/releases/tag/4.9.5","tags":["x_refsource_MISC","web"]},{"url":"https://github.com/getkirby/kirby/releases/tag/5.5.2","tags":["x_refsource_MISC","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75594","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-9vx2-j98c-p72w"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75594.json","tags":["advisory"]},{"url":"https://github.com/getkirby/kirby","tags":["package"]}],"sources":{"cve":[{"id":"CVE-2026-75594","title":"Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling","description":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.","status":"published","published":"2026-08-31T20:53:00.338Z","modified":"2026-09-01T14:31:42.348Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high","assessor":"cna"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:20:07.260654Z"}],"euvd":[{"id":"EUVD-2026-68813","description":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.","status":"published","published":"2026-08-31T20:53:00Z","modified":"2026-09-01T14:31:42Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"updated_at":"2026-11-02T18:01:18.264709Z"}],"ghsa":[{"id":"GHSA-9vx2-j98c-p72w","title":"Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling","description":"### TL;DR\n\nThis vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (`%2f`), such as nginx, PHP's built-in server or Apache setups that have the option `AllowEncodedSlashes` enabled.\n \nIt was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the `.json` file extension anywhere on the server.\n \n**This vulnerability is of high severity for affected sites.**\n \nServer setups using Apache's default configuration or other servers that have been hardened against encoded slashes in URLs are *not* affected.\n\n----\n\n### Introduction\n\nA path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as `../`, an attacker can escape that directory and reach files elsewhere on the server.\n\n### Affected components\n\nKirby's media handler processes requests for files in the `media` directory that have not been generated yet. It parses the provided path and finds the correct file or asset from which to generate a thumbnail. Each thumbnail needs to have a prepared job file (a metadata file with file extension `.json`) in order to allow the media handler to generate it.\n \nEach parent (such as a page) has its own media directory, which in turn contains the individual files. Kirby's media handler searches for the file within the parent's media directory.\n\n### Impact\n\nIn affected releases, Kirby did not prevent path traversal in the filenames that were searched within the parent directory. In affected server setups where the attacker can provide encoded slashes (`%2f`) in the request, Kirby allowed the request to traverse away from the parent's media directory.\n \nBecause the response differs between existing and non-existing thumbnail configurations, attackers were able to tell whether an arbitrary JSON file exists on the server (addressed by a relative path from the media directory of an arbitrary existing parent, including a relative path that points outside of the site's `index` root). For existing files with the file extension `.json` and a valid `filename` key (resulting in a valid job file), it was possible to generate thumbnails of the referenced media files, deleting the job file in the process.\n \n### Patches\n\nThe problem has been patched in [Kirby 4.9.5](https://github.com/getkirby/kirby/releases/tag/4.9.5) and [Kirby 5.5.2](https://github.com/getkirby/kirby/releases/tag/5.5.2). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn all of the mentioned releases, `Kirby\\Cms\\Media::thumb()` now rejects any filename that contains path information (anything other than a plain filename) before it is appended to the validated root. We have also hardened the `file::version` component to block paths that contain the `../` sequence.\n\n### Credits\n\nThanks to Jorge González Milla (@Pig-Tail) for responsibly reporting the identified issue.","status":"published","published":"2026-08-31T22:12:45Z","modified":"2026-08-31T22:12:45Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:41:08.980668Z"}],"nvd":[{"id":"CVE-2026-75594","description":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.","status":"published","published":"2026-08-31T21:17:48.76Z","modified":"2026-09-08T21:11:31.703Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T14:12:42.691315Z"}],"osv":[{"id":"CVE-2026-75594","title":"Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling","description":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.","status":"published","published":"2026-08-31T20:53:00.338Z","modified":"2026-11-08T02:47:43.418022519Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-08T03:29:44.777002Z"},{"id":"GHSA-9vx2-j98c-p72w","title":"Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling","description":"### TL;DR\n\nThis vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (`%2f`), such as nginx, PHP's built-in server or Apache setups that have the option `AllowEncodedSlashes` enabled.\n \nIt was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the `.json` file extension anywhere on the server.\n \n**This vulnerability is of high severity for affected sites.**\n \nServer setups using Apache's default configuration or other servers that have been hardened against encoded slashes in URLs are *not* affected.\n\n----\n\n### Introduction\n\nA path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as `../`, an attacker can escape that directory and reach files elsewhere on the server.\n\n### Affected components\n\nKirby's media handler processes requests for files in the `media` directory that have not been generated yet. It parses the provided path and finds the correct file or asset from which to generate a thumbnail. Each thumbnail needs to have a prepared job file (a metadata file with file extension `.json`) in order to allow the media handler to generate it.\n \nEach parent (such as a page) has its own media directory, which in turn contains the individual files. Kirby's media handler searches for the file within the parent's media directory.\n\n### Impact\n\nIn affected releases, Kirby did not prevent path traversal in the filenames that were searched within the parent directory. In affected server setups where the attacker can provide encoded slashes (`%2f`) in the request, Kirby allowed the request to traverse away from the parent's media directory.\n \nBecause the response differs between existing and non-existing thumbnail configurations, attackers were able to tell whether an arbitrary JSON file exists on the server (addressed by a relative path from the media directory of an arbitrary existing parent, including a relative path that points outside of the site's `index` root). For existing files with the file extension `.json` and a valid `filename` key (resulting in a valid job file), it was possible to generate thumbnails of the referenced media files, deleting the job file in the process.\n \n### Patches\n\nThe problem has been patched in [Kirby 4.9.5](https://github.com/getkirby/kirby/releases/tag/4.9.5) and [Kirby 5.5.2](https://github.com/getkirby/kirby/releases/tag/5.5.2). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn all of the mentioned releases, `Kirby\\Cms\\Media::thumb()` now rejects any filename that contains path information (anything other than a plain filename) before it is appended to the validated root. We have also hardened the `file::version` component to block paths that contain the `../` sequence.\n\n### Credits\n\nThanks to Jorge González Milla (@Pig-Tail) for responsibly reporting the identified issue.","status":"published","published":"2026-08-31T22:12:45Z","modified":"2026-08-31T22:40:38.012862Z","cvss":[{"version":"4.0","score":8.2,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N","level":"high"}],"cwes":["CWE-22"],"updated_at":"2026-11-02T15:46:44.225359Z"}]}}