Summary
Kirby: Access to image files outside of the site root via path traversal in the media handling
TL;DR
This vulnerability affects all Kirby sites that are deployed in a way that their index root on the server is next to a second directory that is read-accessible to PHP and shares the same name prefix (such as the site with the index root /var/www/site being next to /var/www/site2).
It was possible to create and access thumbnails from media files within such sibling directories that have a valid thumbnail configuration (JSON job file). This can affect staging sites, site backups or other internal sites.
Introduction
A path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as ../, an attacker can escape that directory and reach files elsewhere on the server.
Affected components
Kirby's media handler processes requests for files in the media directory that have not been generated yet. It parses the provided path and finds the correct file or asset to generate a thumbnail of. Each thumbnail needs to have a prepared job file (a metadata file with file extension .json) in order to allow the media handler to generate a thumbnail.
The media handler uses filesystem containment checks in several places that are supposed to prevent breakout of the media and index roots of the site.
Credits
Thanks to @0x1saac for responsibly reporting the identified issue.
Impact
In affected releases, the containment checks were incomplete and did not cover the case of a sibling directory next to the containment directory that starts with the same prefix. E.g. a directory site2 passed the containment check of directory site. This allowed attackers to access media files with prepared job files that are stored within such sibling directories of the site's index root, opening the potential for information leaks from sensitive files stored within them, and deleting the job file in the process.
Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files. Typical impact: unauthorized file read or write outside the intended directory.
Affected versions
Security releases
Kodem intelligence
Severity tells you how bad this could be in the worst case. It does not tell you whether you are exposed. Exploitability and impact are functions of runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A vulnerable package can sit in your dependency tree and never run.
Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter. Kodem's runtime-powered SCA identifies whether this CVE is reachable in your applications.
Already deployed Kodem?
See it in your environmentNew to Kodem? Get a demo →Remediation advice
The problem has been patched in Kirby 4.9.5 and Kirby 5.5.2. Please update to one of these or a later version to fix the vulnerability.
In all of the mentioned releases, we have hardened the containment helpers Kirby\Filesystem\Dir::realpath() and Kirby\Filesystem\F::realpath() to require either an exact match or a DIRECTORY_SEPARATOR boundary, so that a sibling path sharing the same name prefix can no longer pass the check. This prevents access to files outside the index root of the active site. We have also hardened the Asset class to block paths that contain the ../ sequence.
Frequently Asked Questions
- What is CVE-2026-75592? CVE-2026-75592 is a medium-severity path traversal vulnerability in getkirby/cms (composer), affecting versions < 4.9.5. It is fixed in 4.9.5, 5.5.2. Input manipulates file paths to reach files outside the intended directory, such as configuration or credential files.
- Which versions of getkirby/cms are affected by CVE-2026-75592? getkirby/cms (composer) versions < 4.9.5 is affected.
- Is there a fix for CVE-2026-75592? Yes. CVE-2026-75592 is fixed in 4.9.5, 5.5.2. Upgrade to this version or later.
- Is CVE-2026-75592 exploitable, and should I be worried? Whether CVE-2026-75592 is exploitable in your environment depends on whether the vulnerable code is present and reachable. A CVSS score is a worst-case rating; it does not account for your specific deployment, configuration, or usage patterns. Kodem, an Intelligent Application Security platform, uses runtime intelligence to show which vulnerabilities actually execute in production, so you can focus on the ones that represent real risk. Get a demo
- What actually determines whether CVE-2026-75592 is exploitable, and how bad it is? Exploitability and impact are not fixed properties of a CVE. They depend on runtime truth: whether the vulnerable code is present, reachable, and actually executes in your application. A high CVSS score on a dependency that never runs is not the same as real risk. Kodem, an Intelligent Application Security platform, uses runtime intelligence to reveal which vulnerabilities actually execute in production, so teams prioritize the ones that genuinely matter.
- How do I fix CVE-2026-75592?
- Upgrade
getkirby/cmsto 4.9.5 or later - Upgrade
getkirby/cmsto 5.5.2 or later
- Upgrade