CVE-2026-71415

Kirby CMS, an open-source content management system, versions 5.0.0 through before 5.5.2 contains a missing-authorization flaw (CWE-862) in the REST API chunk upload handler, where the handler in src/Api/Upload.php persisted chunk data via processChunk() before running the upload authorization preflight in process(). An authenticated user who has panel access (access.panel enabled) but lacks files.create, files.replace, and user/users.update permissions can send requests with an Upload-Length header, leaving unfinished chunks stored in site/cache/.uploads for 24 hours. By repeating these requests, the attacker can consume temporary storage, prevent other users from uploading files, or block site logic from storing data, i.e., cause a denial of service, although final permission checks still keep unauthorized files out of the content and site/accounts directories. All Kirby deployments running 5.0.0 to 5.5.1 with the REST API enabled and such restricted panel users are affected. There is no known public proof-of-concept, the issue is not in the CISA KEV catalog, and EPSS estimates only about a 0.2% probability of exploitation within 30 days.

What to do: Upgrade Kirby to version 5.5.2 or later, which runs the upload authorization preflight before persisting chunks. Until upgraded, restrict or disable the REST API for users who do not need it and monitor site/cache/.uploads for accumulating orphaned chunks; note the impact is limited to temporary-storage exhaustion, not unauthorized file creation.