CVE-2026-71415
CVE-2026-71415 · Kirby: File upload permissions are not checked during processing of chunk data
Diese Seite enthält Fakten aus öffentlichen Sicherheitsquellen. Lesen Sie vor dem Aktualisieren die Originalmeldung.
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.
CVSS 7.1 · Hoch · EPSS 0,4% · Korrektur verfügbar
- Veröffentlicht
- Aktualisiert
Technologie-Stack: php
Betroffene Produkte und Versionen
kirby
- Softwareversionen
- >= 5.0.0, < 5.5.2: Betroffen
Keine Korrektur veröffentlicht
getkirby/cms Packagist
- Softwareversionen
- 5.0.0
- 5.0.1
- 5.0.2
- 5.0.3
- 5.0.4
- 5.1.0
- 5.1.0-rc.1
- 5.1.1
- 5.1.2
- 5.1.3
- 5.1.4
- 5.2.0
- 5.2.0-rc.1
- 5.2.1
- 5.2.2
- 5.2.3
- 5.3.0
- 5.3.0-rc.1
- 5.3.1
- 5.3.2
- 5.3.3
- 5.4.0
- 5.4.1
- 5.4.2
- 5.4.3
- 5.4.4
- 5.5.0
- 5.5.1
- Betroffene Versionsbereiche
- ECOSYSTEM: ≥ 5.0.0, < 5.5.2
Auf 5.5.2 aktualisieren