CVE-2026-75594

Kirby, an open-source content management system, is affected by a path traversal (CWE-22) in its media handler: Media::thumb() in src/Cms/Media.php appends a user-controlled filename to an already-validated parent media directory, and the related file::version path in src/Filesystem/Asset.php also accepts ../ sequences beyond the intended index root. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote, unauthenticated attacker can submit encoded slashes such as %2f in the filename, which are decoded after directory validation and let the request traverse outside the parent media directory. By comparing responses for existing and nonexistent thumbnail configurations, the attacker can determine whether arbitrary .json files exist, and a .json file containing a valid filename key can cause the referenced image to be returned and the job file to be deleted, yielding limited information disclosure and file deletion. Sites running Kirby 4.x before 4.9.5 or 5.x before 5.5.2 on the affected server configurations are exposed (CVSS 4.0: 8.2, high). No public proof-of-concept, CISA KEV listing, or confirmed in-the-wild exploitation is known; EPSS currently puts the 30-day exploitation probability at about 0.5%.

What to do: Upgrade to Kirby 4.9.5 on the 4.x line or 5.5.2 on the 5.x line. If patching is delayed, disable AllowEncodedSlashes on Apache or block %2f-encoded slashes in media thumb and file::version URLs at a reverse proxy/WAF, noting that only nginx, PHP built-in server, and Apache-with-AllowEncodedSlashes configurations are described as exposed. Check media directories for missing or altered thumbnail job (.json) files, which would indicate probing or exploitation of this flaw.