Listen to this Post
CVE-2026-71415 is a missing authorization vulnerability in Kirby CMS that affects versions 5.0.0 through 5.5.1. The flaw resides in the REST API chunk upload handler located at src/Api/Upload.php.
To understand how this vulnerability works, it is necessary to examine the chunked upload mechanism introduced in Kirby 5. The REST API provides routes for creating content files, replacing existing files, and managing user avatars. Each upload route supports both full-file and chunked uploads, where large files are split into smaller pieces and reassembled on the server.
During a chunked upload, the incomplete file state is stored in a temporary directory until the final chunk arrives. Only at completion are the final permission and business logic checks performed before the complete file is moved to its destination. The vulnerability arises because the system invokes `Kirby\Api\Upload::process()` to handle multipart uploads, but prior to version 5.5.2, this method failed to execute the necessary preflight authorization check before calling Kirby\Api\Upload::processChunk(). This function directly persists chunk data to the filesystem without first verifying whether the authenticated user possesses the required permissions.
An authenticated user with `access.panel` permission enabled but with files.create, files.replace, and `user/users.update` permissions all disabled can exploit this gap. By submitting requests with an `Upload-Length` header, the attacker triggers the creation of temporary chunk files in `site/cache/.uploads` without triggering a rejection based on insufficient privileges. These unfinished chunks remain stored for 24 hours before automatic cleanup. By repeatedly submitting incomplete upload requests, an attacker can systematically fill available disk space. Importantly, final permission checks still prevent unauthorized files from reaching sensitive directories like `content` or site/accounts. The vulnerability aligns with CWE-862 (Missing Authorization) and has been assigned a CVSS v4.0 base score of 7.1 (High). The issue is fixed in Kirby version 5.5.2.
DailyCVE Form:
Platform: Kirby CMS
Version: 5.0.0–5.5.1
Vulnerability: Missing Authorization
Severity: High (CVSS 7.1)
Date: 2026-08-31
Prediction: Patch already released
What Undercode Say:
Check Kirby version composer show getkirby/cms | grep versions Identify vulnerable chunk upload handler cat src/Api/Upload.php | grep -A 10 "processChunk" Monitor temporary uploads directory for unusual activity ls -la site/cache/.uploads/ find site/cache/.uploads/ -type f -mmin -60 Check for excessive disk usage from incomplete chunks du -sh site/cache/.uploads/
// The vulnerable code path in Kirby\Api\Upload::process() // Prior to 5.5.2, process() called processChunk() without preflight authorization // Fixed by adding preflight checks before persisting chunk data // Vulnerable flow: // process() -> processChunk() [NO permission check] -> persists chunk // Fixed flow (5.5.2+): // process() -> preflight authorization check -> processChunk() -> persists chunk
Exploit: (Educational Purposes!)
An authenticated attacker with `access.panel` but no file upload permissions can:
1. Send a series of chunked upload requests to the REST API endpoint
2. Include the `Upload-Length` header to initiate chunk storage
3. Never send the final chunk to complete the upload
4. Repeat the process to consume temporary storage space
5. Continue until disk exhaustion prevents legitimate operations
The attack does not require any file upload permission—only REST API access and authentication.
Protection:
- Upgrade to Kirby version 5.5.2 or later immediately
- If immediate upgrade is not possible, manually disable the REST API for roles that should not have upload permissions
- Monitor `site/cache/.uploads/` directory for unexpected growth
- Implement disk usage alerts to detect storage exhaustion attempts
- Restrict `access.panel` permission to only trusted users
Impact:
- Availability: Attackers can fill temporary storage, preventing legitimate users from uploading files and disrupting site logic that depends on storage
- Integrity: No direct file corruption; final permission checks prevent unauthorized files from reaching content directories
- Confidentiality: No data exposure; the attack is limited to resource exhaustion
- Scope: All Kirby sites from versions 5.0.0 to 5.5.1 where users have REST API access but no upload permissions
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
