CVE-2026-75594

Name of the Vulnerable Software and Affected Versions Kirby versions prior to 4.9.5 Kirby versions prior to 5.5.2

Description A path traversal issue exists in the media handler where untrusted input is used to build a filesystem path without proper confinement to the intended base directory. In environments that allow encoded slashes (%2f) in URLs—such as nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled—a remote attacker can traverse outside the parent media directory. This is possible via the KirbyCmsMedia::thumb() function in src/Cms/Media.php and the file::version path in src/Filesystem/Asset.php, which accepted ../ sequences outside the index root. An attacker can disclose the existence of arbitrary .json files on the server based on response differences. Furthermore, if a .json file contains a valid filename key, the referenced image can be returned and the associated job file deleted.

Recommendations Update Kirby to version 4.9.5 or later. Update Kirby to version 5.5.2 or later.