Summary
Kirby: File upload permissions are not checked during processing of chunk data
TL;DR
This vulnerability affects all Kirby sites where users of a particular role have access to the REST API (access.panel permission is enabled) but no permission to upload any kind of file (files.create, files.replace and user/users.update permissions are all disabled).
It was possible to fill up the temporary directory for chunked uploads with unfinished chunks even as a user without any upload permission.
This vulnerability is of high severity for affected sites.
Your Kirby sites are not affected if you intend all users of your site to be able to upload files. The vulnerability can only be exploited by authenticated users. It was not possible to bypass the actual permission checks for any files that end up in the content or site/accounts folders.
Introduction
Missing authorization allows authenticated users to perform actions they are not intended to have access to.
The effects of missing authorization can include unauthorized access to sensitive information as well as unauthorized changes to content or system information.
Affected components
Kirby's REST API provides routes to upload files, specifically to create content files, replace existing content files and to create and replace user avatars.
Each upload route takes either full file upload requests or chunked upload requests that can be continued in subsequent requests.
During a chunked upload, the incomplete state of the uploaded file is stored in a temporary directory until the last chunk completes the file. At this time, the final permission and business logic checks are performed before the complete file is moved to its final destination.
Credits
Thanks to @alcls01111 for responsibly reporting the identified issue.
Impact
In affected releases, the chunk upload handler did not check for the user's file upload permissions before storing incomplete chunk data in the temporary directory.
This allowed attackers without upload permissions to upload multiple large files in chunks. If the final chunk was never provided, Kirby would keep the incomplete files for 24 hours. This could cause attacker-controlled storage consumption until the temporary files were automatically cleaned up or manually removed, potentially preventing other users from uploading files, or site logic from storing data.
The application does not perform an authorization check before performing a sensitive operation. Typical impact: unauthorized access to restricted functionality or data.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The problem has been patched in Kirby 5.5.2. Please update this or a later version to fix the vulnerability.
In all of the mentioned releases, we have added preflight checks to the upload chunk processor that verify the relevant system permission before storing the chunk data in the temporary directory.
Frequently Asked Questions
- What is CVE-2026-71415? CVE-2026-71415 is a high-severity missing authorization vulnerability in getkirby/cms (composer), affecting versions >= 5.0.0, < 5.5.2. It is fixed in 5.5.2. The application does not perform an authorization check before performing a sensitive operation.
- Which versions of getkirby/cms are affected by CVE-2026-71415? getkirby/cms (composer) versions >= 5.0.0, < 5.5.2 is affected.
- Is there a fix for CVE-2026-71415? Yes. CVE-2026-71415 is fixed in 5.5.2. Upgrade to this version or later.
- Is CVE-2026-71415 exploitable, and should I be worried? Whether CVE-2026-71415 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-71415 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-71415? Upgrade
getkirby/cmsto 5.5.2 or later.