CVE-2026-71415: Missing Authorization in Kirby CMS REST API Chunked Upload Handler
Vulnerability ID: CVE-2026-71415
CVSS Score: 7.1
Published: 2026-08-31
A missing authorization vulnerability (CWE-862) in Kirby CMS (versions 5.0.0 through 5.5.1) allows low-privileged authenticated users with Panel access to write temporary chunk files to disk, leading to potential Denial of Service via storage exhaustion.
TL;DR
Authenticated users lacking file creation or modification privileges can bypass authorization during the file ingestion phase. This allows them to write temporary chunk files to the server's cache directory that persist for 24 hours, presenting a low-complexity vector for disk exhaustion and Denial of Service.
Technical Details
- CWE ID: CWE-862 (Missing Authorization)
- Attack Vector: Network
- CVSS v4.0 Score: 7.1 (High)
- Exploit Status: None
- KEV Status: Not Listed
- Ransomware Use: No
Affected Systems
- Kirby CMS
-
kirby: >= 5.0.0, < 5.5.2 (Fixed in:
5.5.2)
Code Analysis
Commit: 37e206f
Fix missing authorization check in chunked file upload handler
Mitigation Strategies
- Upgrade Kirby CMS to version 5.5.2 or later to enforce preflight upload authorization checks.
- Restrict user accounts on the Kirby administrative Panel to essential personnel only.
- Implement disk space monitoring and enforce directory size limits on the PHP web server process.
Remediation Steps:
- Review current Kirby CMS deployment versions using the administrative dashboard or composer.json.
- Update Kirby CMS dependencies to 5.5.2 or higher by running 'composer update getkirby/cms'.
- Validate the update by testing file upload behaviors with a low-privileged editor account to confirm access is restricted.
References
Read the full report for CVE-2026-71415 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)