Kirby 5.5.2 Security Release: Path Traversal & Missing Upload Permission Fixes (CVE-2026-7594, 7415, 69127, 75892)

Critical Information Summary of the Kirby 5.5.2 Security Update Overview of the Vulnerabilities Kirby 5.5.2 is part of the monthly security release series and primarily fixes several security vulnerabilities: 1. Path Traversal Vulnerability (High Severity) - CVE ID: CVE-2026-7594 - CVSS Score: 8.2 - Description: In media handling, path traversal allows access to image files and limited JSON files outside the site root directory. - Scope of Impact: Kirby sites deployed on servers that allow encoded slashes (%2F) in request URLs, or with an Apache configuration where the option is enabled. - Remediation: and have been patched to fix path traversal via prefix matching, now requiring exact matching or a boundary. 2. Missing File Upload Permission Check (High Severity) - CVE ID: CVE-2026-7415 - CVSS Score: 7.1 - Description: File upload permissions were not checked when handling chunked data. - Scope of Impact: Kirby sites using the REST API where specific roles ( permission) did not have permission to upload any type of file (with , , and permissions all disabled). - Remediation: Chunked file uploads now verify the user's upload permissions before writing any data, preventing users without upload permission from leaving partial files in . Chunked uploads now enforce the file template's , maintain consistency across all chunks, and reject requests that change the file template or the total upload length. 3. System Path Exposure in REST API (Medium Severity) - CVE ID: CVE-2026-69127 - CVSS Score: 6.9 - Description: In the REST API, error messages exposed the system file paths of the Kirby installation. - Scope of Impact: Kirby sites that have not disabled the REST API, using the option. - Remediation: now rejects paths containing the sequence to protect against path traversal. The API hides the error file path in debug mode, displaying only a generic error in auto-debug mode. 4. Path Traversal in Media Handling (Medium Severity) - CVE ID: CVE-2026-75892 - CVSS Score: 6.9 - Description: Path traversal allows access to image files outside the site root directory. - Scope of Impact: Deployments where the site's root directory is located on the server adjacent to a directory that is readable by PHP and shares the same name as the site (e.g., the site is in an root directory, with adjacent to ). - Remediation: The class and the helper no longer accept paths containing the sequence to protect against path traversal. Scope of Impact All Kirby sites using the REST API Kirby sites deployed on servers that allow encoded slashes Kirby sites using chunked file uploads Kirby sites where the REST API has not been disabled Remediation Fixed path traversal vulnerabilities via prefix matching and exact matching Fixed the issue of missing file upload permission checks Fixed system path exposure in the REST API Fixed path traversal issues in media handling POC or Exploit Code The page does not include specific POC code or exploit code.

Goal Reached Thanks to every supporter — we hit 100%!

Kirby 5.5.2 Security Release: Path Traversal & Missing Upload Permission Fixes (CVE-2026-7594, 7415, 69127, 75892)

More from this source