CVE-2026-75594: Kirby path traversal in media handler via encoded slashes

CVE-2026-75594 · Severity: high · CVSS 4 · Published 2026-08-31

Kirby is a popular headless CMS used to manage website content and media files. A path traversal vulnerability in its media handling system allows attackers on servers with certain configurations to access image files and detect the existence of JSON configuration files stored outside the intended media directory. Attackers can exploit this by injecting encoded slashes into request URLs to escape the media folder and access files elsewhere on the server.

Technologies: getkirby/cms (Packagist). Vendors: Packagist.

Quick answers

Is CVE-2026-75594 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-75594 being exploited in the wild.
How severe is CVE-2026-75594?
High severity, with a CVSS score of 4, published 31 August 2026.
Which products and versions are affected?
getkirby/cms (Packagist) ECOSYSTEM:introduced=0,fixed=4.9.5.
Is there a fix for CVE-2026-75594?
Yes. getkirby/cms (Packagist): upgrade to 4.9.5 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-75594 attacked?
It is attacked over the network.
Am I affected by CVE-2026-75594?
Check whether you run getkirby/cms (Packagist) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • getkirby/cms (Packagist): upgrade to 4.9.5 or later
    composer require getkirby/cms:^4.9.5

Technical details

The vulnerability is a classic path traversal flaw in Kirby's media handler component (Kirby\Cms\Media::thumb()). The handler processes requests for thumbnails of media files and uses job files (JSON metadata files) to determine how to generate them. The flaw occurs because the handler did not properly validate filenames before constructing filesystem paths, allowing attackers to inject path traversal sequences like `../` and encoded slashes (`%2f`). On servers that allow URL-encoded slashes (nginx, PHP built-in server, or Apache with AllowEncodedSlashes enabled), an attacker can craft requests that escape the parent media directory and access arbitrary files on the server. The vulnerability enables two attacks: (1) enumeration of JSON files anywhere on the server through timing/response differences, and (2) generation of thumbnail images from media files referenced by valid job files, effectively reading file contents. The fix, released in Kirby 4.9.5 and 5.5.2, rejects filenames containing path information and blocks paths with `../` sequences before appending them to the validated root.

Affected products

  • getkirby Kirby CMS 4.9.4 and earlier, 5.0.0 through 5.5.1

Identifiers

  • CVE-2026-75594
  • GHSA-9vx2-j98c-p72w

Timeline

  • 2026-08-31: disclosed: Published to GitHub Advisory Database
  • 2026-08-31: patched: Kirby 4.9.5 and 5.5.2 released with fixes

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.