SB2026072036 - Multiple vulnerabilities in Kirby

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB2026072036

SB2026072036 - Multiple vulnerabilities in Kirby

Published: July 20, 2026

Security Bulletin ID SB2026072036
CSH Severity
Medium
Patch available
YES
Number of vulnerabilities 4
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

Medium 50% Low 50%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 4 vulnerabilities.


1) Exposure of Sensitive System Information to an Unauthorized Control Sphere (CVE-ID: N/A)

CWE-ID: CWE-497 - Exposure of Sensitive System Information to an Unauthorized Control Sphere

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose sensitive system information.

The vulnerability exists due to exposure of sensitive system information in the REST API error handler when handling crafted API requests that trigger internal errors. A remote attacker can send a specially crafted request to disclose sensitive system information.

The issue can expose the full filesystem path of the installation, and unauthenticated API access is sufficient when the REST API is enabled.


2) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:U/U:Green


The vulnerability allows a remote attacker to disclose information about the presence of arbitrary JSON files on the server and access image files outside of the site root.

The vulnerability exists due to path traversal in the media handler when handling requests with encoded slashes in media file paths. A remote attacker can send a specially crafted request to disclose information about the presence of arbitrary JSON files on the server and access image files outside of the site root.

Only server setups that allow requests containing encoded slashes are affected. For existing JSON files with a valid thumbnail job configuration, thumbnail generation can access referenced media files and deletes the job file in the process.


3) Path traversal (CVE-ID: N/A)

CWE-ID: CWE-22 - Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote attacker to disclose sensitive information.

The vulnerability exists due to path traversal in the media handler when processing requests for ungenerated media thumbnails. A remote attacker can send a specially crafted request to disclose sensitive information.

Exploitation is possible only when the site index root is adjacent to a PHP-readable sibling directory sharing the same name prefix, and the targeted media file has a prepared thumbnail job file.


4) Missing Authorization (CVE-ID: N/A)

CWE-ID: CWE-862 - Missing Authorization

CVSSv4: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear


The vulnerability allows a remote user to cause a denial of service.

The vulnerability exists due to missing authorization in the chunk upload handler of the REST API when processing chunked upload requests. A remote user can upload multiple large unfinished file chunks to cause a denial of service.

Exploitation requires access to the REST API while file upload permissions are disabled, and incomplete chunks can remain in temporary storage for 24 hours if the final chunk is never sent.


Remediation

Install update from vendor's website.

References