Listen to this Post
The vulnerability arises from an incomplete filesystem containment check within Kirby’s media handler. When a request for an uncached thumbnail arrives, the system parses the URI to locate the source file and its associated JSON job file, which contains thumbnail generation parameters. The media handler attempts to confine all operations to the site’s `index` root and `media` directory using helper functions like `Kirby\Filesystem\Dir::realpath()` and Kirby\Filesystem\F::realpath(). These helpers resolve symlinks and canonicalize paths, then verify that the resolved path starts with the allowed base directory. However, the verification logic used a simple string prefix match (e.g., str_starts_with($resolved, $base)) without enforcing a directory separator boundary after the base path. This allowed a path like `/var/www/site2/thumb.json` to pass the check when the base was /var/www/site, because the prefix matches. The attacker only needs to know or guess the name of a sibling directory that is read-accessible to PHP and has a valid thumbnail job file. The media handler also uses the presence of `../` sequences in the initial input, but the earlier containment check effectively neutralized the need for `../` because the sibling path is not outside the base—it is adjacent, sharing the same parent. By crafting a request that points to a media file inside such a sibling directory (e.g., site2/media/pages/home/test.jpg), the attacker can trigger thumbnail generation. The system reads the job file from that sibling, generates the thumbnail, and serves it back, leaking the content. Additionally, the generation process deletes the job file after use, causing a denial of service for that thumbnail on the sibling site. The patch introduced in Kirby 4.9.5 and 5.5.2 modifies `realpath()` to require either an exact match or a trailing `DIRECTORY_SEPARATOR` after the base path, so `/var/www/site2` no longer passes for base /var/www/site. The `Asset` class was also hardened to explicitly block any path containing `../` as a defense-in-depth measure. This vulnerability is particularly dangerous in shared hosting or staging environments where multiple Kirby instances reside in sibling directories with similar prefixes.
DailyCVE Form:
Platform: Kirby CMS
Version: <4.9.5,<5.5.2
Vulnerability: Path Traversal
Severity: Medium
date: 2026-08-30
Prediction: Already Patched (2026-08-30)
What Undercode Say:
Check for sibling directories sharing a prefix with the current index root
ls -la /var/www/ | grep -E "^site"
List JSON job files in a suspected sibling media directory
find /var/www/site2/media -name ".json" -type f
Test containment bypass using a crafted URL (example)
curl -I "https://example.com/media/site2/pages/about/cover.jpg.thumb.jpg?width=200"
Verify the realpath fix by comparing resolved paths
php -r "echo realpath('/var/www/site/../site2') . PHP_EOL;" Should resolve to /var/www/site2
After patch, check that the helper rejects it (simulated)
php -r "require 'kirby/src/Filesystem/Dir.php'; var_dump(\Kirby\Filesystem\Dir::realpath('/var/www/site2', '/var/www/site'));"
Exploit: (Educational Purposes!)
- Enumerate the server’s parent directory to find sibling folders (e.g.,
site_staging,site_backup) via error messages or directory listing. - Identify a valid thumbnail job file in that sibling’s media directory, typically named after the source file with a `.json` extension.
- Craft a request to Kirby’s media endpoint using the sibling’s relative path, e.g.,
/media/sibling_name/pages/example/test.jpg.thumb.jpg?width=100. - The server processes the request, reads the job file from the sibling, generates the thumbnail, and returns the image data.
- The job file is deleted after generation, so repeat for each target file to exfiltrate content.
Protection:
Update to Kirby 4.9.5 or 5.5.2 immediately. If patching is delayed, apply a temporary rewrite rule in `.htaccess` or Nginx to block any URI containing `../` or references to sibling directories. Ensure that all Kirby instances are deployed with unique, non-prefix-sharing parent directories, or isolate them using Docker/containers. Monitor access logs for unexpected media requests to directories outside the known site root.
Impact:
An attacker can read any media file (images, PDFs, etc.) from staging, backup, or internal Kirby sites that reside in a sibling directory with a common name prefix, provided those files have a valid JSON job file. This leads to leakage of sensitive content, including internal documents, design assets, or configuration-related images. The deletion of job files also disrupts thumbnail generation on the affected sibling site, potentially causing 404 errors and degrading user experience. No code execution or database compromise is possible, but information disclosure can facilitate further attacks.
🎯Let’s Practice Exploiting & Learn Patching For Free:
🎓 Live Courses & Certifications:
Join Undercode Academy for Verified Certifications
🚀 Request a Custom Project:
Secure, high-velocity infrastructure and disruptive technological engineering. Contact our engineering team for high-tier development and proprietary systems:
[email protected]
💎 Smart Architecture | 🛡️ Secure by Design | ⭐ Trusted by Thousands
Sources:
Reported By: github.com
Extra Source Hub:
Undercode
