{"id":"CVE-2026-75594","aliases":["GHSA-9vx2-j98c-p72w"],"url":"https://o3.security/vulnerability/CVE-2026-75594","summary":"Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling","details":"### TL;DR\n\nThis vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (`%2f`), such as nginx, PHP's built-in server or Apache setups that have the option `AllowEncodedSlashes` enabled.\n \nIt was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the `.json` file extension anywhere on the server.\n \n**This vulnerability is of high severity for affected sites.**\n \nServer setups using Apache's default configuration or other servers that have been hardened against encoded slashes in URLs are *not* affected.\n\n----\n\n### Introduction\n\nA path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as `../`, an attacker can escape that directory and reach files elsewhere on the server.\n\n### Affected components\n\nKirby's media handler processes requests for files in the `media` directory that have not been generated yet. It parses the provided path and finds the correct file or asset from which to generate a thumbnail. Each thumbnail needs to have a prepared job file (a metadata file with file extension `.json`) in order to allow the media handler to generate it.\n \nEach parent (such as a page) has its own media directory, which in turn contains the individual files. Kirby's media handler searches for the file within the parent's media directory.\n\n### Impact\n\nIn affected releases, Kirby did not prevent path traversal in the filenames that were searched within the parent directory. In affected server setups where the attacker can provide encoded slashes (`%2f`) in the request, Kirby allowed the request to traverse away from the parent's media directory.\n \nBecause the response differs between existing and non-existing thumbnail configurations, attackers were able to tell whether an arbitrary JSON file exists on the server (addressed by a relative path from the media directory of an arbitrary existing parent, including a relative path that points outside of the site's `index` root). For existing files with the file extension `.json` and a valid `filename` key (resulting in a valid job file), it was possible to generate thumbnails of the referenced media files, deleting the job file in the process.\n \n### Patches\n\nThe problem has been patched in [Kirby 4.9.5](https://github.com/getkirby/kirby/releases/tag/4.9.5) and [Kirby 5.5.2](https://github.com/getkirby/kirby/releases/tag/5.5.2). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.\n\nIn all of the mentioned releases, `Kirby\\Cms\\Media::thumb()` now rejects any filename that contains path information (anything other than a plain filename) before it is appended to the validated root. We have also hardened the `file::version` component to block paths that contain the `../` sequence.\n\n### Credits\n\nThanks to Jorge González Milla (@Pig-Tail) for responsibly reporting the identified issue.","published":"2026-08-31T20:53:00.338Z","modified":"2026-09-10T03:30:31.612473431Z","cvss":null,"epss":{"score":0.00513,"percentile":0.42456,"asOf":"2026-09-16"},"cisaKev":null,"exploitsKnown":0,"affectedPackages":[{"ecosystem":"Packagist","name":"getkirby/cms","fixedVersion":"4.9.5"},{"ecosystem":"Packagist","name":"getkirby/cms","fixedVersion":"5.5.2"}],"fix":{"url":"https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9","label":"getkirby/kirby@22fbaed"},"references":[{"type":"WEB","url":"https://github.com/getkirby/kirby/releases/tag/4.9.5"},{"type":"WEB","url":"https://github.com/getkirby/kirby/releases/tag/5.5.2"},{"type":"ADVISORY","url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/75xxx/CVE-2026-75594.json"},{"type":"ADVISORY","url":"https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75594"},{"type":"FIX","url":"https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9"},{"type":"FIX","url":"https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20"},{"type":"FIX","url":"https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e"},{"type":"FIX","url":"https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c"},{"type":"PACKAGE","url":"https://github.com/getkirby/kirby"}],"provenance":{"sources":["OSV.dev","FIRST.org (EPSS)"],"lastVerified":"2026-09-10T03:30:31.612473431Z"}}