CVE-2026-75592

Received Received - Intake

Path Traversal in Kirby CMS

Publication date: 2026-08-31

Last updated on: 2026-08-31

Assigner: GitHub, Inc.

Description

Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\Filesystem\Dir::realpath() and Kirby\Filesystem\F::realpath(). The checks accepted a sibling directory whose path shared the intended root's string prefix, such as /var/www/site2 next to /var/www/site, because they did not require an exact match or a DIRECTORY_SEPARATOR boundary. A remote attacker could use Kirby\Cms\Media::thumb() to create and access thumbnails from image files in a PHP-readable sibling directory when that directory contained a valid .json thumbnail job file, potentially exposing staging sites, backups, or other internal sites and deleting the job file during processing. This issue is fixed in versions 4.9.5 and 5.5.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-08-31

Last Modified

2026-08-31

Generated

2026-09-01

AI Q&A

2026-09-01

EPSS Evaluated

N/A

NVD

CVE-2026-75592

Affected Vendors & Products

Vendor	Product	Version / Range
kirby	kirby	to 4.9.5 (inc)
kirby	kirby	to 5.5.2 (inc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-22	The product uses external input to construct a pathname that is intended to identify a file or directory that is located underneath a restricted parent directory, but the product does not properly neutralize special elements within the pathname that can cause the pathname to resolve to a location that is outside of the restricted directory.

Attack-Flow Graph

Executive Summary

Kirby CMS versions before 4.9.5 and 5.5.2 had a flaw in its media handler where filesystem containment checks were incomplete. The system incorrectly accepted sibling directories with path prefixes, like /var/www/site2 next to /var/www/site, due to missing exact match or directory separator checks. This allowed attackers to access thumbnails from image files in adjacent directories by exploiting a .json thumbnail job file.

Impact Analysis

An attacker could exploit this to access sensitive files in sibling directories, such as staging sites, backups, or internal sites. They could also delete thumbnail job files during processing, potentially disrupting operations or exposing confidential data.

Compliance Impact

This vulnerability could lead to unauthorized access to sensitive data, violating compliance requirements like GDPR or HIPAA, which mandate strict data protection and access controls. Exposure of personal or health information may result in legal penalties or breaches of regulatory standards.

Mitigation Strategies

Update Kirby to version 4.9.5 or 5.5.2 or later to address the filesystem containment issue. Review media handling and thumbnail generation processes for unauthorized access attempts.

Hi! I’m here to help you understand CVE-2026-75592. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70