https://vulnerability.circl.lu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 10:15:26 +0000 https://vulnerability.circl.lu/vuln/fkie_cve-2026-75594 <p>Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby&#39;s media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP&#39;s built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent&#39;s media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.</p> <p>Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby&#39;s media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP&#39;s built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent&#39;s media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.</p> https://vulnerability.circl.lu/vuln/fkie_cve-2026-75594 https://vulnerability.circl.lu/vuln/ghsa-9vx2-j98c-p72w <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (`%2f`), such as nginx, PHP&#39;s built-in server or Apache setups that have the option `AllowEncodedSlashes` enabled. It was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the `.json` file extension anywhere on the server. **This vulnerability is of high severity for affected sites.** Server setups using Apache&#39;s default configuration or other servers that have been hardened against encoded slashes in URLs are *not* affected.</p> <p>----</p> <p>### Introduction</p> <p>A path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as `../`, an attacker can escape that directory and reach files elsewhere on the server.</p> <p>### Affected components</p> <p>Kirby&#39;s media handler processes requests for files in the `media` directory that have not been generated yet. It parses the provided path and finds the correct file or asset from which to generate a thumbnail. Each thumbnail needs to have a prepared job file (a metadata file with file extension `.json`) in order to allow the media handler to generate it. Each parent (such as a page…</p> <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### TL;DR</p> <p>This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (`%2f`), such as nginx, PHP&#39;s built-in server or Apache setups that have the option `AllowEncodedSlashes` enabled. It was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the `.json` file extension anywhere on the server. **This vulnerability is of high severity for affected sites.** Server setups using Apache&#39;s default configuration or other servers that have been hardened against encoded slashes in URLs are *not* affected.</p> <p>----</p> <p>### Introduction</p> <p>A path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as `../`, an attacker can escape that directory and reach files elsewhere on the server.</p> <p>### Affected components</p> <p>Kirby&#39;s media handler processes requests for files in the `media` directory that have not been generated yet. It parses the provided path and finds the correct file or asset from which to generate a thumbnail. Each thumbnail needs to have a prepared job file (a metadata file with file extension `.json`) in order to allow the media handler to generate it. Each parent (such as a page…</p> https://vulnerability.circl.lu/vuln/ghsa-9vx2-j98c-p72w