Iniciar sesión
Deutsch English Español Polski
Media

Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5

  • Publicada: 08.12.2020
  • Actualizado: 11.10.2026 10:22

Impact

An editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file.

Visitors without Panel access cannot use this attack vector.

Patches

The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability.

Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

Workarounds

Kirby 2 sites on older releases can also be patched by applying the changes from this commit.

Credits

Thanks to Thore Imhof of Accenture for reporting the problem.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Paquete de Composer getkirby/cms >= 3.0.0, < 3.4.5 3.4.5
Paquete de Composer getkirby/panel < 2.5.14 2.5.14

Referencias

Puntuación CVSS 6.8/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Debilidad (CWE)
CWE-434
Plataforma
Composer
Paquete
getkirby/cms, getkirby/panel
Publicada
08.12.2020
Actualizado
11.10.2026 10:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-g3h8-cg9x-47qw - CC BY 4.0

Historial de vulnerabilidades: getkirby/cms

Todas las vulnerabilidades publicadas de este paquete (Paquete de Composer), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (51) en el archivo
Entradas en total
51
Primera → última
12.2020 09.2026
Sin corrección
2
Explotada en ataques
0

Distribución por gravedad

  • Crítica 1
  • Alta 19
  • Media 30
  • Baja 1

Divulgaciones por año

Gravedad:
  1. Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5 esta entrada
    Media · 6.8 CVE-2020-26255 >= 3.0.0, < 3.4.5 3.4.5
  2. Kirby: File upload permissions are not checked during processing of chunk data
    Alta CVE-2026-71415 >= 5.0.0, < 5.5.2 5.5.2
  3. Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling
    Alta CVE-2026-75594 < 4.9.5, >= 5.0.0, < 5.5.2 4.9.5, 5.5.2
  4. Kirby: `pages.access` permission is not checked in the `site/find` REST API route
    Alta CVE-2026-54005 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  5. Kirby: External Initialization of the Panel on reverse proxy setups with the `Forwarded` header
    Crítica CVE-2026-54003 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  6. Kirby: Cross-site scripting (XSS) from incomplete HTML/XML sanitization in `Dom::sanitize()`
    Alta CVE-2026-54002 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  7. Kirby: Self cross-site scripting (self-XSS) in the writer field
    Alta CVE-2026-49276 < 4.9.4, >= 5.0.0-alpha.1, < 5.4.4 4.9.4, 5.4.4
  8. Kirby CMS vulnerable to cross-site scripting (XSS) from links in KirbyTags and image blocks in the site frontend
    Alta CVE-2026-45368 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  9. Kirby CMS has pre-authentication path traversal and PHP file inclusion during user lookup
    Alta CVE-2026-44177 >= 5.3.0, < 5.4.1 5.4.1
  10. Kirby CMS vulnerable to cross-site scripting (XSS) from list field content in the site frontend
    Alta CVE-2026-44175 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  11. Kirby CMS has an Arbitrary Method Call via REST API Search and Collection Query Endpoints
    Alta CVE-2026-44174 < 4.9.1, >= 5.0.0, < 5.4.1 4.9.1, 5.4.1
  12. Kirby CMS's read access to site, user and role information is not gated by permissions
    Alta CVE-2026-42069 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  13. Kirby CMS's `pages.access/list` and `files.access/list` permissions are not consistently checked in the Panel and REST API
    Alta CVE-2026-42137 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  14. Kirby is vulnerable to authorization bypass during page, file and user creation via blueprint injection
    Alta CVE-2026-41325 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  15. Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
    Alta · 8.1 CVE-2026-34587 < 4.9.0, >= 5.0.0, < 5.4.0 4.9.0, 5.4.0
  16. Kirby has insufficient permission checks in the language settings
    Alta · 8.1 CVE-2024-41964 < 3.6.6.6, >= 3.7.0, < 3.7.5.5, >= 3.8.0, < 3.8.4.4, >= 3.9.0, < 3.9.8.2, >= 3.10.0, < 3.10.1.1, >= 4.0.0, < 4.3.1 3.6.6.6, 3.7.5.5, 3.8.4.4, 3.9.8.2, 3.10.1.1, 4.3.1
  17. Field injection in the KirbyData text storage handler
    Alta · 7.1 CVE-2023-38488 < 3.5.8.3, >= 3.6.0, < 3.6.6.3, >= 3.7.0, < 3.7.5.2, >= 3.8.0, < 3.8.4.1, >= 3.9.0, < 3.9.6 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
  18. Insufficient Session Expiration after a password change
    Alta · 7.3 CVE-2023-38489 < 3.5.8.3, >= 3.6.0, < 3.6.6.3, >= 3.7.0, < 3.7.5.2, >= 3.8.0, < 3.8.4.1, >= 3.9.0, < 3.9.6 3.5.8.3, 3.6.6.3, 3.7.5.2, 3.8.4.1, 3.9.6
  19. Cross-site scripting from content entered in the tags and multiselect fields
    Alta · 7.1 ghsa-rv3r-vqjj-8c76 >= 3.5.7, < 3.5.8.1, >= 3.6.0, < 3.6.6.1, >= 3.7.0, < 3.7.4 3.5.8.1, 3.6.6.1, 3.7.4
  20. Cross-site scripting (XSS) from field and configuration text displayed in the Panel
    Alta · 7.1 CVE-2021-32735 < 3.5.7 3.5.7
  21. Cross-site scripting (XSS) from unsanitized uploaded SVG files in Kirby
    Alta · 7.6 CVE-2021-29460 < 3.5.4 3.5.4

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.