Log in Start free

Vulnerability · Published Aug 31, 2026 · Assigned by GitHub_M

CVE-2026-71415Kirby: File upload permissions are not checked during processing of chunk data

High 7.1

In plain English

A high-severity missing authorization in kirby from getkirby. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)7.1High
Exploit odds (30 days)0.4%top 62.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Packagistgetkirby/cms5.5.2GHSA-67mx-6wf2-92xp

Affected products (as reported)

VendorProductVersions
getkirby kirby >= 5.0.0, < 5.5.2

Weakness: CWE-862 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References