Executive brief
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5
Affected products
- Packagist getkirby/panel
- Packagist getkirby/cms
Junglewise Threat Intelligence
CVE-2020-26255: Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5
CVE-2020-26255 · Severity: low · CVSS 3.1 · Published 2020-12-08
Technologies: getkirby/cms (Packagist). Vendors: Packagist.
Related threats
- Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did n
- Kirby CMS path traversal and PHP file inclusion in user lookup
- Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload
- Kirby is missing permission checks in the content changes API
- Kirby CMS has cross-site scripting (XSS) in the changes dialog