{"id":"CVE-2026-75594","title":"Kirby is an open-source content management system","summary":"Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated pare…","severity":"high","cwe":["CWE-22"],"vendor":"getkirby","product":"getkirby/cms","affected":["getkirby/cms <= 4.9.4","getkirby/cms >= 5.0.0, < 5.5.2"],"patched":["getkirby/cms 4.9.5","getkirby/cms 5.5.2"],"published":"2026-08-31","updated":"2026-09-08","sourceUpdated":"2026-09-08T21:11:31.703","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-75594","references":[{"url":"https://github.com/getkirby/kirby/commit/22fbaedb7e6dd61f5def10829ba7bd7e73e0dcc9","label":"security-advisories@github.com"},{"url":"https://github.com/getkirby/kirby/commit/a40808f5c2ee5d42bb597fb6ffbe0de0ce8e4d20","label":"security-advisories@github.com"},{"url":"https://github.com/getkirby/kirby/commit/cd7abb68d298f3443eafd43fa2d0c7ad0f933d0e","label":"security-advisories@github.com"},{"url":"https://github.com/getkirby/kirby/commit/e0dca5f709adc21b36f5549df2c0619bc59da56c","label":"security-advisories@github.com"},{"url":"https://github.com/getkirby/kirby/releases/tag/4.9.5","label":"security-advisories@github.com"},{"url":"https://github.com/getkirby/kirby/releases/tag/5.5.2","label":"security-advisories@github.com"},{"url":"https://github.com/getkirby/kirby/security/advisories/GHSA-9vx2-j98c-p72w","label":"security-advisories@github.com"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-75594"},{"url":"https://github.com/advisories/GHSA-9vx2-j98c-p72w"}],"tags":["nvd","ghsa","composer"],"epss":0.00513,"epssPercentile":0.42557,"aliases":["GHSA-9vx2-j98c-p72w"],"ecosystem":"composer","ingestedAt":"2026-08-31T22:14:59.068Z","slug":"CVE-2026-75594","body":"## Overview\n\nKirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\\Cms\\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Package advisory (CVE-2026-75594)\n\nAffected packages:\n\n- `getkirby/cms <= 4.9.4`\n- `getkirby/cms >= 5.0.0, < 5.5.2`\n\nPatched in:\n\n- `getkirby/cms 4.9.5`\n- `getkirby/cms 5.5.2`\n\nSource: https://github.com/advisories/GHSA-9vx2-j98c-p72w","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}