{"id":"CVE-2026-71415","title":"Kirby is an open-source content management system","summary":"Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\\Api\\Upload::process() before Kirby\\Ap…","severity":"high","cwe":["CWE-862"],"vendor":"getkirby","product":"getkirby/cms","affected":["getkirby/cms >= 5.0.0, < 5.5.2"],"patched":["getkirby/cms 5.5.2"],"published":"2026-08-31","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:11:31.703","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-71415","references":[{"url":"https://github.com/getkirby/kirby/commit/37e206f3ed40ad3fab2e47e055ccb19e9c207dab","label":"security-advisories@github.com"},{"url":"https://github.com/getkirby/kirby/pull/8296","label":"security-advisories@github.com"},{"url":"https://github.com/getkirby/kirby/releases/tag/5.5.2","label":"security-advisories@github.com"},{"url":"https://github.com/getkirby/kirby/security/advisories/GHSA-67mx-6wf2-92xp","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-71415"},{"url":"https://github.com/advisories/GHSA-67mx-6wf2-92xp"}],"tags":["nvd","ghsa","composer"],"epss":0.00246,"epssPercentile":0.16131,"aliases":["GHSA-67mx-6wf2-92xp"],"ecosystem":"composer","ingestedAt":"2026-08-31T22:14:58.987Z","slug":"CVE-2026-71415","body":"## Overview\n\nKirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\\Api\\Upload::process() before Kirby\\Api\\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-71415)\n\nAffected packages:\n\n- `getkirby/cms >= 5.0.0, < 5.5.2`\n\nPatched in:\n\n- `getkirby/cms 5.5.2`\n\nSource: https://github.com/advisories/GHSA-67mx-6wf2-92xp","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0,"exploitation":0,"ransomware":0},"changes":[]}