Path traversal in Kirby - CVE-2026-75594
Published: July 20, 2026 / Updated: September 1, 2026
Vulnerability details
The vulnerability allows a remote attacker to disclose information about the presence of arbitrary JSON files on the server and access image files outside of the site root.
The vulnerability exists due to path traversal in the media handler when handling requests with encoded slashes in media file paths. A remote attacker can send a specially crafted request to disclose information about the presence of arbitrary JSON files on the server and access image files outside of the site root.
Only server setups that allow requests containing encoded slashes are affected. For existing JSON files with a valid thumbnail job configuration, thumbnail generation can access referenced media files and deletes the job file in the process.