CVE-2026-75592: Kirby: Access to image files outside of the site root via path traversal in the media handling
TL;DR
This vulnerability affects all Kirby sites that are deployed in a way that their index root on the server is next to a second directory that is read-accessible to PHP and shares the same name prefix (such as the site with the index root /var/www/site being next to /var/www/site2).
It was possible to create and access thumbnails from media files within such sibling directories that have a valid thumbnail configuration (JSON job file). This can affect staging sites, site backups or other internal sites.
----
Introduction
A path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as ../, an attacker can escape that directory and reach files elsewhere on the server.
Affected components
Kirby's media handler processes requests for files in the media directory that have not been generated yet. It parses the provided path and finds the correct file or asset to generate a thumbnail of. Each thumbnail needs to have a prepared job file (a metadata file with file extension .json) in order to allow the media handler to generate a thumbnail.
The media handler uses filesystem containment checks in several places that are supposed to prevent breakout of the media and index roots of the site.
Impact
In affected releases, the containment checks were incomplete and did not cover the case of a sibling directory next to the containment directory that starts with the same prefix. E.g. a directory site2 passed the containment check of directory site. This allowed attackers to access media files with prepared job files that are stored within such sibling directories of the site's index root, opening the potential for information leaks from sensitive files stored within them, and deleting the job file in the process.
Patches
The problem has been patched in Kirby 4.9.5 and Kirby 5.5.2. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, we have hardened the containment helpers Kirby\Filesystem\Dir::realpath() and Kirby\Filesystem\F::realpath() to require either an exact match or a DIRECTORYSEPARATOR boundary, so that a sibling path sharing the same name prefix can no longer pass the check. This prevents access to files outside the index root of the active site. We have also hardened the Asset class to block paths that contain the ../ sequence.
Credits
Thanks to @0x1saac for responsibly reporting the identified issue.
Other sources
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler used incomplete filesystem containment checks in src/Filesystem/Dir.php and src/Filesystem/F.php through Kirby\Filesystem\Dir::realpath() and Kirby\Filesystem\F::realpath(). The checks accepted a sibling directory whose path shared the intended root's string prefix, such as /var/www/site2 next to /var/www/site, because they did not require an exact match or a DIRECTORYSEPARATOR boundary. A remote attacker could use Kirby\Cms\Media::thumb() to create and access thumbnails from image files in a PHP-readable sibling directory when that directory contained a valid .json thumbnail job file, potentially exposing staging sites, backups, or other internal sites and deleting the job file during processing. This issue is fixed in versions 4.9.5 and 5.5.2.
— NVD
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
composer/getkirby/cmsto a version that resolves this vulnerability.Fixed in 5.5.2 - Upgrade
Upgrade
composer/getkirby/cmsto a version that resolves this vulnerability.Fixed in 4.9.5 - Upgrade
Upgrade
Kirbyto a version that resolves this vulnerability.Fixed in 4.9.5 - Upgrade
Upgrade
Kirbyto a version that resolves this vulnerability.Fixed in 5.5.2
Event History
Frequently Asked Questions
Which deployments are realistically exposed to this issue?
Deployments running Kirby versions earlier than 4.9.5 or 5.5.2 are affected, depending on their release line. Exploitation also requires a PHP-readable sibling directory whose filesystem path shares the site root's prefix, such as a site directory next to another directory named with the same prefix.
What does an attacker need to exploit the flaw?
A remote attacker needs to invoke Kirby's media thumbnail handling against an image in a PHP-readable sibling directory. That directory must contain a valid .json thumbnail job file for the media handler to process.
What could be exposed or changed during exploitation?
An attacker can create and access thumbnails derived from image files outside the intended site root, which could expose images from staging sites, backups, or other internal sites. Processing may also delete the thumbnail job file in the sibling directory.
What should be done if an upgrade cannot happen immediately?
The provided information identifies the required exposure conditions but does not specify an official workaround. Prioritize preventing PHP access to sibling directories containing sensitive images and thumbnail job files until upgrading to 4.9.5 or 5.5.2, as appropriate for the release line.