Quick answers
- Is CVE-2026-71415 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-71415 being exploited in the wild.
- How severe is CVE-2026-71415?
- High severity, with a CVSS score of 4, published 31 August 2026.
- Which products and versions are affected?
- getkirby/cms (Packagist) >= 5.0.0, < 5.5.2, ECOSYSTEM:introduced=5.0.0,fixed=5.5.2.
- Is there a fix for CVE-2026-71415?
- Yes. getkirby/cms (Packagist): upgrade to 5.5.2 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
- How is CVE-2026-71415 attacked?
- It is attacked over the network, in a web application.
- Am I affected by CVE-2026-71415?
- Check whether you run getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
How to fix
- getkirby/cms (Packagist): upgrade to 5.5.2 or later
composer require getkirby/cms:^5.5.2
Technical details
The vulnerability is a missing authorization (CWE-862) in Kirby's REST API file upload handler. The chunked upload processor stores incomplete file chunks in a temporary directory until the final chunk is received, at which point permission checks are performed before moving the file to its destination. However, the permission checks were not performed before storing chunks, allowing authenticated users with REST API access but without file upload permissions (files.create, files.replace, user/users.update disabled) to submit large file chunks indefinitely. Incomplete chunks are retained for 24 hours before automatic cleanup. An attacker can exploit this to cause denial of service by exhausting temporary storage, blocking legitimate uploads and potentially disrupting site operations. The vulnerability requires authentication (Privileges Required: Low) and network access, but affects only the temporary directory; files stored in content or site/accounts folders remain protected by integrity checks. The fix was released in Kirby 5.5.2 by adding preflight permission checks before chunk storage.
Affected products
- Getkirby Kirby >= 5.0.0, < 5.5.2
Identifiers
- CVE-2026-71415
- GHSA-67mx-6wf2-92xp
Timeline
- 2026-07-15: disclosed: Initial publication date in GitHub Advisory Database
- 2026-08-31: advisory: Published by National Vulnerability Database and updated on GitHub Advisory Database
- 2026-08-31: patched: Patch released in Kirby 5.5.2