CVE-2026-71415

Name of the Vulnerable Software and Affected Versions Kirby versions 5.0.0 through 5.5.1

Description Kirby's REST API chunk upload handler in src/Api/Upload.php fails to perform authorization preflight checks in the process() function before the processChunk() function persists data. This allows an authenticated user who has the access.panel permission but lacks files.create, files.replace, and user/users.update permissions to submit requests using an Upload-Length header. By doing so, the user can leave unfinished chunks in the site/cache/.uploads directory for 24 hours. This can lead to attacker-controlled temporary storage consumption, which may prevent other users from uploading files or hinder site logic from storing data. Final permission checks still prevent unauthorized files from being moved to the content or site/accounts directories.

Recommendations Update Kirby to version 5.5.2 or later.