CVE-2026-75592

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.5 Kirby versions prior to 5.5.2

Description The media handler in this content management system uses incomplete filesystem containment checks within src/Filesystem/Dir.php and src/Filesystem/F.php via the functions KirbyFilesystemDir::realpath() and KirbyFilesystemF::realpath(). These checks fail to require an exact match or a DIRECTORY SEPARATOR boundary, allowing the acceptance of sibling directories that share the same string prefix as the intended root. A remote attacker can exploit this by using KirbyCmsMedia::thumb() to create and access thumbnails from image files located in a PHP-readable sibling directory, provided that directory contains a valid .json thumbnail job file. This could lead to the exposure of internal sites, backups, or staging environments and result in the deletion of the job file during processing.

Recommendations Update to version 4.9.5 or later. Update to version 5.5.2 or later.