CVE-2026-71415High▾ TwilightKirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Ap…
▾ Twilight zone — High severity, or a signal on a lesser flaw
impact 41.3 · likelihood 0 · exploitation 0
Need a working PoC? Pro members can cast a request and our team develops one — it lands right here.
Exploit-prediction probability, daily snapshots since Sep 1.
Disclosure to exploitation, from the record and what we observed since indexing it.
Disclosed via NVD
0.2%
Last analysed / modified upstream
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.
Refer to the linked advisories for vendor-supplied fixes and affected version ranges.
Affected packages:
getkirby/cms >= 5.0.0, < 5.5.2Patched in:
getkirby/cms 5.5.2Connected by shared product, vendor, weakness, or advisory.
CVE-2026-75592MediumKirby is an open-source content management system
CVE-2026-75594HighKirby is an open-source content management system
CVE-2026-49274MediumKirby: `pages.access` permission is not checked in the pages picker for parent pages
CVE-2026-54004MediumKirby: Access to files of top-level drafts is not protected by permissions
CVE-2026-54005HighKirby: `pages.access` permission is not checked in the `site/find` REST API route
CVE-2026-69127MediumKirby is an open-source content management system