CVE-2026-75594: Critical Path Traversal and Directory Containment Bypass in Kirby CMS

The media and asset management subsystems in Kirby CMS are designed to dynamically process, resize, and serve assets to web visitors. In versions of Kirby prior to 4.9.5 and 5.5.2, these components fail to sanitize user-supplied input parameters properly, creating a direct path traversal attack surface.

An attacker can supply URL-encoded directory traversal strings such as %2f or %5c to bypass routing filters. If the underlying server environment does not automatically decode and normalize these slashes prior to passing the request context to the PHP runtime, the filesystem API processes them as active relative directory indicators.

This vulnerability is tracked as CVE-2026-75594 and GHSA-9vx2-j98c-p72w. It introduces two distinct flaws: an unchecked filename concatenation inside the dynamic thumbnail generator and a prefix matching logical vulnerability within the realpath containment checks of the directory utility classes. The resulting security exposure allows unauthenticated directory scanning, local JSON file read, file deletion, and file existence confirmation.

The primary root cause lies in the core dynamic thumbnail endpoint helper situated within src/Cms/Media.php. When processing dynamic thumbnail generation requests, Kirby relies on a configuration job file to parse and save options. The resolution of the parent media storage root is safely handled using realpath lookups, but the actual requested filename parameter is appended directly to the base path.

Because the $filename variable is not subjected to strict local filename checks, it can contain relative traversal sequences. When the concatenation happens, the resolving path escapes the bounds of the validated parent directory. If a file is successfully processed or recognized as a completed job, the application also attempts a cleanup sequence which deletes the parsed configuration JSON file.

In addition to the filename validation gap, Kirby's internal security logic in Dir::realpath and F::realpath contains a prefix matching logic flaw. The containment check attempts to verify whether a canonicalized child path lies within a permitted parent directory using simple prefix validation. Because it lacks a trailing directory separator constraint, an attacker can target sibling folders sharing a partial string prefix, such as accessing /var/www/site-conf when authorized only for /var/www/site.

To understand the vulnerabilities completely, we analyze the vulnerable execution paths and the corresponding fixes introduced by the maintainers.

// Vulnerable snippet in src/Cms/Media.php
$root = Dir::realpath($root, $media);
$thumb = $root . '/' . $filename;
$job   = $root . '/.jobs/' . $filename . '.json';

The code above illustrates the unsafe concatenation. The variable $filename is taken directly from the route context without any baseline check. The patch introduced a validation block utilizing the basename function to enforce that the filename is strictly flat:

// Patched snippet in src/Cms/Media.php
$root = Dir::realpath($root, $media);
if (
    $filename === '' ||
    $filename === '.' ||
    $filename === '..' ||
    basename($filename) !== $filename
) {
    throw new InvalidArgumentException();
}
$thumb = $root . '/' . $filename;

Additionally, the prefix matching checks inside the core containment functions were updated to prevent sibling directories from satisfying the validation logic. The fix appends the OS-specific directory separator to the parent path prior to executing prefix validation:

// Patched containment logic in src/Filesystem/Dir.php
$parent = rtrim($parent, '/\');
if (
    $realpath !== $parent &&
    str_starts_with($realpath, $parent . DIRECTORY_SEPARATOR) === false
) {
    throw new Exception('The directory is not within the parent directory');
}

The exploitation of CVE-2026-75594 depends on the deployment environment and the server's handling of encoded slashes. In a standard Nginx environment where path normalization is turned off, or in Apache setups where AllowEncodedSlashes On is active, encoded characters pass to the PHP-FPM gateway intact.

An attacker crafts a request targeting the media directory and injects encoded traversal sequences to point to sensitive JSON files. For example, a target path of ../../site/accounts/user.json can be encoded. When processed, if the targeted file exists, the dynamic router reacts with a distinct error signature, allowing file discovery.

Furthermore, if the target JSON file contains valid keys structured like a thumbnail generation configuration, the clean-up logic inside Kirby will automatically execute a file delete routine on the path. This allows remote attackers to delete arbitrary JSON metadata on the filesystem. The flowchart below outlines the execution flow of the directory containment bypass:

The impact of CVE-2026-75594 is assessed as High, with a CVSS v4.0 score of 8.2. Unauthenticated remote attackers can leverage the directory traversal and containment bypass to perform reconnaissance on target environments by identifying critical configuration structures.

While direct remote code execution is not achievable solely via the path traversal, the ability to disclose the existence of JSON files can leak sensitive data such as application metadata, configuration details, list of accounts, or backend transaction records. The secondary risk of file deletion introduces an availability risk where key system states can be disrupted by removing operational files.

Security teams should note that this vulnerability does not require prior privileges or authentication. It can be triggered over the network directly against any publicly accessible Kirby CMS installation running on a vulnerable web server setup.

The primary remediation strategy is upgrading Kirby core to the patched releases. Deployments running the Kirby 4 release line must update to version 4.9.5 or higher. Deployments running the Kirby 5 release line must update to 5.5.2 or higher.

When immediate patching is not possible, security teams must enforce path normalization at the web server level. For Nginx, ensure that rewrite rules or location handlers filter out encoded slash sequences before forwarding requests to PHP. For Apache, configure rewrite rules to deny requests containing encoded slashes entirely.

Furthermore, system administrators should ensure that the web service runs under a low-privileged OS user account with strict write and delete permissions restricted only to the necessary media and cache directories. This containment limits the damage an attacker can inflict if they attempt to trigger file deletions.