CVE-2026-75594 – Path Traversal / Unauthorized File Access – Kirby CMS < 4.9.5 and 5.0.0–5.5.1

Summary

CVE-2026-75594 is a high-severity path traversal vulnerability (CWE-22) in the media handler of Kirby CMS, an open-source PHP content management system. The flaw allows an unauthenticated, remote attacker to submit crafted filenames containing encoded slash characters (%2f) to escape the intended media directory, enabling disclosure of image files, exposure of whether arbitrary JSON files exist, and generation of thumbnails from files outside the site root. The issue has a CVSS v4.0 base score of 8.2 (High) and was fixed in Kirby 4.9.5 and 5.5.2.

Technical details

• Root cause: Kirby’s KirbyCmsMedia class (src/Cms/Media.php) did not properly neutralize special path elements in requested filenames before resolving them within the media directory, and related filesystem helpers (Dir::realpath() / F::realpath()) validated containment using a string-prefix comparison rather than requiring an exact match or a DIRECTORY_SEPARATOR boundary.
• Trigger conditions: Exploitation requires the web/application server to accept and forward URL-encoded slash sequences (%2f) to PHP unmodified. Confirmed vulnerable configurations include nginx, PHP’s built-in development server, and Apache with AllowEncodedSlashes enabled. Apache deployments using default settings (which reject encoded slashes) are not affected by this specific vector.
• Attack vector: Network-based, no authentication or user interaction required (AV:N/PR:N/UI:N), but exploitation is dependent on the specific server configuration handling encoded slashes (AT:P).
• Impact: Attackers can retrieve image files stored outside the intended media/site root, generate thumbnails from arbitrary accessible files, and determine the existence of JSON files elsewhere on the filesystem, resulting in a confidentiality impact rated High under CVSS v4.0 (VC:H). No direct impact on integrity or availability was scored for this CVE, though the same 5.5.2 release also hardened related filesystem and asset-handling code against separate path traversal and file-deletion risks.

Affected software

• Kirby CMS versions prior to 4.9.5
• Kirby CMS versions 5.0.0 through 5.5.1 (inclusive)

Severity

• CVSS v4.0 Base Score: 8.2 (High)
• Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

Mitigation and recommended actions

• Immediate: Upgrade to Kirby 4.9.5 (for 4.x deployments) or Kirby 5.5.2 (for 5.x deployments), both of which reject path traversal attempts in the media handler, Asset class, and asset() helper, and enforce exact-match/boundary checks in Dir::realpath() and F::realpath().
• If immediate patching is not possible: Where feasible, disable or block support for URL-encoded slash characters at the web server layer (e.g., ensure AllowEncodedSlashes is not enabled on Apache, or add rewrite/request-filtering rules on nginx and other reverse proxies to reject %2f sequences in request paths) to reduce exposure until the update can be applied. This is a mitigation, not a substitute for patching, since other traversal vectors were also addressed in the same release.

References

• CVE-2026-75594 at NVD
• GitHub Security Advisory GHSA-9vx2-j98c-p72w
• Kirby 5.5.2 Release Notes