---
id: CVE-2026-71415
title: Kirby is an open-source content management system
summary: >-
  Kirby is an open-source content management system. From 5.0.0 until 5.5.2,
  Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the
  relevant upload authorization preflight in Kirby\Api\Upload::process() before
  Kirby\Ap…
severity: high
cwe:
  - CWE-862
vendor: getkirby
product: getkirby/cms
affected:
  - 'getkirby/cms >= 5.0.0, < 5.5.2'
patched:
  - getkirby/cms 5.5.2
published: '2026-08-31'
updated: '2026-09-08'
sourceUpdated: '2026-09-08T21:11:31.703'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71415'
references:
  - url: >-
      https://github.com/getkirby/kirby/commit/37e206f3ed40ad3fab2e47e055ccb19e9c207dab
    label: security-advisories@github.com
  - url: 'https://github.com/getkirby/kirby/pull/8296'
    label: security-advisories@github.com
  - url: 'https://github.com/getkirby/kirby/releases/tag/5.5.2'
    label: security-advisories@github.com
  - url: 'https://github.com/getkirby/kirby/security/advisories/GHSA-67mx-6wf2-92xp'
    label: security-advisories@github.com
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2026-71415'
  - url: 'https://github.com/advisories/GHSA-67mx-6wf2-92xp'
tags:
  - nvd
  - ghsa
  - composer
epss: 0.00246
epssPercentile: 0.16131
aliases:
  - GHSA-67mx-6wf2-92xp
ecosystem: composer
ingestedAt: '2026-08-31T22:14:58.987Z'
---

## Overview

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.

## Package advisory (CVE-2026-71415)

Affected packages:

- `getkirby/cms >= 5.0.0, < 5.5.2`

Patched in:

- `getkirby/cms 5.5.2`

Source: https://github.com/advisories/GHSA-67mx-6wf2-92xp