Missing Authorization in Kirby - CVE-2026-71415
Published: July 20, 2026 / Updated: September 1, 2026
Vulnerability identifier: #VU138448
CSH Severity: Low
CVSS v4: 7.1 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-71415
CWE-ID: CWE-862
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote user to cause a denial of service.
The vulnerability exists due to missing authorization in the chunk upload handler of the REST API when processing chunked upload requests. A remote user can upload multiple large unfinished file chunks to cause a denial of service.
Exploitation requires access to the REST API while file upload permissions are disabled, and incomplete chunks can remain in temporary storage for 24 hours if the final chunk is never sent.
Affected software
Kirby
How to mitigate CVE-2026-71415
Install security update from vendor's website.
Kirby - update to 5.5.2