Executive brief
Kirby is a popular open-source headless CMS used to manage website content and user accounts. The REST API allows users with panel access to upload files through a chunked upload mechanism. A missing authorization check allows authenticated users without upload permissions to fill the temporary directory with incomplete file chunks, potentially exhausting disk space and preventing legitimate users from uploading files or the system from storing critical data.
Technical details
The vulnerability is a missing authorization (CWE-862) in Kirby's REST API file upload handler. The chunked upload processor stores incomplete file chunks in a temporary directory until the final chunk is received, at which point permission checks are performed before moving the file to its destination. However, the permission checks were not performed before storing chunks, allowing authenticated users with REST API access but without file upload permissions (files.create, files.replace, user/users.update disabled) to submit large file chunks indefinitely. Incomplete chunks are retained for 24 hours before automatic cleanup. An attacker can exploit this to cause denial of service by exhausting temporary storage, blocking legitimate uploads and potentially disrupting site operations. The vulnerability requires authentication (Privileges Required: Low) and network access, but affects only the temporary directory; files stored in content or site/accounts folders remain protected by integrity checks. The fix was released in Kirby 5.5.2 by adding preflight permission checks before chunk storage.
Affected products
- Getkirby Kirby >= 5.0.0, < 5.5.2
Timeline
- 2026-07-15: disclosed: Initial publication date in GitHub Advisory Database
- 2026-08-31: advisory: Published by National Vulnerability Database and updated on GitHub Advisory Database
- 2026-08-31: patched: Patch released in Kirby 5.5.2