Path traversal in Kirby - #VU138446

Detailed vulnerability description

The vulnerability allows a remote attacker to disclose information about the presence of arbitrary JSON files on the server and access image files outside of the site root.

The vulnerability exists due to path traversal in the media handler when handling requests with encoded slashes in media file paths. A remote attacker can send a specially crafted request to disclose information about the presence of arbitrary JSON files on the server and access image files outside of the site root.

Only server setups that allow requests containing encoded slashes are affected. For existing JSON files with a valid thumbnail job configuration, thumbnail generation can access referenced media files and deletes the job file in the process.

Remediation

Sources

• https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w
• https://github.com/getkirby/kirby/releases/tag/4.9.5