CVE-2026-75594: Critical Path Traversal and Directory Containment Bypass in Kirby CMS
Vulnerability ID: CVE-2026-75594
CVSS Score: 8.2
Published: 2026-08-31
A critical path traversal vulnerability was discovered in the Kirby CMS media component. Prior to versions 4.9.5 and 5.5.2, Kirby failed to validate path-traversal indicators in requested filenames, allowing attackers to check for the existence of local JSON files, delete them, or bypass directory prefix containment logic under certain web server configurations.
TL;DR
Unauthenticated remote attackers can read and delete local JSON files or bypass directory sandbox containment via URL-encoded path traversal sequences in Kirby CMS.
Technical Details
- CWE ID: CWE-22
- Attack Vector: Network
- CVSS Score: 8.2 (High)
- EPSS Score: N/A
- Exploit Status: poc
- KEV Status: Not Listed
Affected Systems
- Kirby CMS Core < 4.9.5
- Kirby CMS Core >= 5.0.0, < 5.5.2
-
kirby: < 4.9.5 (Fixed in:
4.9.5) -
kirby: >= 5.0.0, < 5.5.2 (Fixed in:
5.5.2)
Code Analysis
Commit: 22fbaed
Fix containment bypass and limit media traversal
Commit: a40808f
Validate path structure inside directory wrapper
Commit: cd7abb6
Improve asset class containment checks
Commit: e0dca5f
Strict verification for thumbnail generator options
Mitigation Strategies
- Upgrade Kirby CMS core to versions 4.9.5, 5.5.2, or higher.
- Normalize URL-encoded slashes at the web server level (e.g. Nginx, Apache).
- Deploy web application firewall (WAF) rules to detect and block directory traversal characters.
Remediation Steps:
- Identify current Kirby version by inspecting composer.json or the Kirby system panel.
- Execute 'composer update getkirby/cms' to fetch the latest secure releases.
- Verify the patch version matches either 4.9.5+ or 5.5.2+.
- Disable 'AllowEncodedSlashes' in Apache or configure path filtering in Nginx server blocks.
References
Read the full report for CVE-2026-75594 on our website for more details including interactive diagrams and full exploit analysis.
Top comments (0)