CVE-2026-71415: Kirby: File upload permissions are not checked during processing of chunk data
TL;DR
This vulnerability affects all Kirby sites where users of a particular role have access to the REST API (access.panel permission is enabled) but no permission to upload any kind of file (files.create, files.replace and user/users.update permissions are all disabled).
It was possible to fill up the temporary directory for chunked uploads with unfinished chunks even as a user without any upload permission.
This vulnerability is of high severity for affected sites.
Your Kirby sites are not affected if you intend all users of your site to be able to upload files. The vulnerability can only be exploited by authenticated users. It was not possible to bypass the actual permission checks for any files that end up in the content or site/accounts folders.
----
Introduction
Missing authorization allows authenticated users to perform actions they are not intended to have access to.
The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.
Affected components
Kirby's REST API provides routes to upload files, specifically to create content files, replace existing content files and to create and replace user avatars.
Each upload route takes either full file upload requests or chunked upload requests that can be continued in subsequent requests. During a chunked upload, the incomplete state of the uploaded file is stored in a temporary directory until the last chunk completes the file. At this time, the final permission and business logic checks are performed before the complete file is moved to its final destination.
Impact
In affected releases, the chunk upload handler did not check for the user's file upload permissions before storing incomplete chunk data in the temporary directory.
This allowed attackers without upload permissions to upload multiple large files in chunks. If the final chunk was never provided, Kirby would keep the incomplete files for 24 hours. This could cause attacker-controlled storage consumption until the temporary files were automatically cleaned up or manually removed, potentially preventing other users from uploading files, or site logic from storing data.
Patches
The problem has been patched in Kirby 5.5.2. Please update this or a later version to fix the vulnerability.
In all of the mentioned releases, we have added preflight checks to the upload chunk processor that verify the relevant system permission before storing the chunk data in the temporary directory.
Credits
Thanks to @alcls01111 for responsibly reporting the identified issue.
Other sources
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.
— MITRE
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/getkirby/cmsto a version that resolves this vulnerability.Fixed in 5.5.2 - Upgrade
Upgrade
Kirbyto a version that resolves this vulnerability.Fixed in 5.5.2Patch Kirby 5.5.2
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the access.panel permission enabled. The issue applies even when that user lacks files.create, files.replace, and user/users.update permissions.
What is the practical impact of exploitation?
An attacker can repeatedly create unfinished upload chunks in site/cache/.uploads, where they remain for 24 hours, consuming temporary storage. This can block other uploads or prevent site logic from storing data, but it does not allow unauthorized files to reach the content or site/accounts directories.
Are installations on the fixed release affected?
No. The issue is fixed in Kirby version 5.5.2; affected versions are from 5.0.0 until 5.5.2.
How can I check for signs of attempted exploitation?
Inspect site/cache/.uploads for unfinished chunk data, particularly unexpected accumulation of temporary upload data. Chunks created through this path remain for 24 hours.