CVE-2026-71415: Kirby: File upload permissions are not checked during processing of chunk data
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Kirbyto a version that resolves this vulnerability.Fixed in 5.5.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the access.panel permission enabled. The issue applies even when that user lacks files.create, files.replace, and user/users.update permissions.
What is the practical impact of exploitation?
An attacker can repeatedly create unfinished upload chunks in site/cache/.uploads, where they remain for 24 hours, consuming temporary storage. This can block other uploads or prevent site logic from storing data, but it does not allow unauthorized files to reach the content or site/accounts directories.
Are installations on the fixed release affected?
No. The issue is fixed in Kirby version 5.5.2; affected versions are from 5.0.0 until 5.5.2.
How can I check for signs of attempted exploitation?
Inspect site/cache/.uploads for unfinished chunk data, particularly unexpected accumulation of temporary upload data. Chunks created through this path remain for 24 hours.