Executive brief
Kirby is a popular headless CMS used to manage website content and media files. A path traversal vulnerability in its media handling system allows attackers on servers with certain configurations to access image files and detect the existence of JSON configuration files stored outside the intended media directory. Attackers can exploit this by injecting encoded slashes into request URLs to escape the media folder and access files elsewhere on the server.
Technical details
The vulnerability is a classic path traversal flaw in Kirby's media handler component (Kirby\Cms\Media::thumb()). The handler processes requests for thumbnails of media files and uses job files (JSON metadata files) to determine how to generate them. The flaw occurs because the handler did not properly validate filenames before constructing filesystem paths, allowing attackers to inject path traversal sequences like `../` and encoded slashes (`%2f`). On servers that allow URL-encoded slashes (nginx, PHP built-in server, or Apache with AllowEncodedSlashes enabled), an attacker can craft requests that escape the parent media directory and access arbitrary files on the server. The vulnerability enables two attacks: (1) enumeration of JSON files anywhere on the server through timing/response differences, and (2) generation of thumbnail images from media files referenced by valid job files, effectively reading file contents. The fix, released in Kirby 4.9.5 and 5.5.2, rejects filenames containing path information and blocks paths with `../` sequences before appending them to the validated root.
Affected products
- getkirby Kirby CMS 4.9.4 and earlier, 5.0.0 through 5.5.1
Timeline
- 2026-08-31: disclosed: Published to GitHub Advisory Database
- 2026-08-31: patched: Kirby 4.9.5 and 5.5.2 released with fixes