Vulnerability · Published Mar 26, 2026 · Assigned by mitre

CVE-2026-29905

Medium 6.5

In plain English

A medium-severity improper input validation in the getkirby/cms package (Packagist). Proof-of-concept exploit code is public. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)6.5Medium

Exploit odds (30 days)0.5%top 59.7% of all CVEs

Exploited in the wildNo reportsCISA SSVC: poc

Attack toolingNoneno public tooling known

Official description

Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.

Affected packages & fixed versions

Ecosystem	Package	Fixed in	Advisory
Packagist	getkirby/cms	5.2.0-rc.1	GHSA-cw7v-45wm-mcf2

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

Weakness: CWE-252, CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

In plain English

Official description

Affected packages & fixed versions

Affected products (as reported)

References