CVE-2020-26255: PHP Phar archives could be uploaded and executed in Kirby
First published: Tue Dec 08 2020(Updated: )
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
Credit: security-advisories@github.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Getkirby Kirby | <3.4.5 | |
| Getkirby Panel | <2.5.14 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881
- https://github.com/getkirby/kirby/commit/db8f371b13036861c9cc5ba3e85e27f73fce5e09
- https://github.com/getkirby/kirby/releases/tag/3.4.5
- https://github.com/getkirby/kirby/security/advisories/GHSA-g3h8-cg9x-47qw
- https://packagist.org/packages/getkirby/cms
- https://packagist.org/packages/getkirby/panel
Frequently Asked Questions
What is CVE-2020-26255?
CVE-2020-26255 is a vulnerability in Kirby CMS that allows an editor with full access to the Kirby Panel to upload and execute a PHP .phar file on the server.
What is the severity of CVE-2020-26255?
CVE-2020-26255 has a severity rating of 9.1 (Critical).
Which versions of Kirby CMS are affected by CVE-2020-26255?
Kirby CMS versions up to and excluding 3.4.5 are affected by CVE-2020-26255.
Which versions of Kirby Panel are affected by CVE-2020-26255?
Kirby Panel versions up to and excluding 2.5.14 are affected by CVE-2020-26255.
How can I fix CVE-2020-26255?
To fix CVE-2020-26255, you should upgrade to Kirby CMS version 3.4.5 or above, and Kirby Panel version 2.5.14 or above.
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- agent/remedy
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/last-modified-date
- agent/title
- agent/severity
- agent/author
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- vendor/getkirby
- canonical/getkirby kirby
- canonical/getkirby panel