CVE-2026-71415

Executive Summary

CVE-2026-71415 is an authorization bypass vulnerability in Kirby CMS's REST API chunk upload handler affecting versions 5.0.0 through 5.5.2. An authenticated user with only the access.panel permission (but lacking files.create, files.replace, and user/users.update permissions) can trigger the chunk upload processing path and persist incomplete temporary data to the site/cache/.uploads directory for 24 hours without proper authorization preflight checks. Repeated exploitation allows an attacker to consume arbitrary storage space, potentially causing denial-of-service conditions that prevent legitimate file uploads or data persistence operations across the site.

Technical Analysis

The vulnerability resides in Kirby's REST API chunk upload mechanism, specifically in the src/Api/Upload.php file. The core issue is a missing authorization preflight check: the Kirby\Api\Upload::process() method does not invoke the relevant upload authorization verification before calling Kirby\Api\Upload::processChunk() to persist chunk data to disk.

The attack mechanism leverages the chunked upload protocol, where clients submit file data in multiple sequential requests, typically using an Upload-Length header to declare the total payload size. In vulnerable versions, an attacker crafts a request with the Upload-Length header but issues requests that carry insufficient or zero actual payload data. Because the authorization check is performed after chunk persistence (or not at all for the chunk-writing phase), the server writes the incomplete chunk data to the site/cache/.uploads directory regardless of the user's file-related permissions.

The incomplete chunks remain stored for a 24-hour retention period, after which they are automatically cleaned. However, an attacker can repeat the process continuously, filling the temporary storage directory. The impact on storage consumption is bounded only by the attacker's ability to generate repeated requests and the server's disk allocation.

It is important to note that final permission checks are still enforced — the unauthorized user cannot cause completed files to be written to the content directory or site/accounts directory. The flaw is specifically in the intermediate persistence step, where the system trusts that an authorized preflight check has been performed before chunk data is staged for later assembly.

The relevant authorization verification that should be performed includes checks against the files.create, files.replace, and user/users.update permissions. On a properly configured instance, users lacking these permissions should never reach the chunk persistence logic. In vulnerable versions, the processChunk() method executes before the authorization check, violating the privilege boundary.

Exploitation Scenarios

Scenario 1: Storage Exhaustion Denial-of-Service

1. Reconnaissance: The attacker identifies a Kirby CMS instance (version 5.0.0 through 5.5.2) with the Panel enabled and authenticates as a low-privileged user possessing only the access.panel permission. This could be a content editor account with deliberately restricted file permissions.

2. Flaw Trigger: The attacker submits a REST API request to the chunk upload endpoint with an Upload-Length header declaring a large payload size. The request arrives without the standard authorization preflight being executed, so the processChunk() method is invoked despite the user lacking files.create or files.replace permissions.

3. Payload Execution: The attacker intentionally sends incomplete chunk data — for example, declaring a 100MB upload length but only transmitting a few bytes of actual chunk content. The chunk persistence logic in processChunk() stages the partial data in site/cache/.uploads/ without validating the declared size against actual received data.

4. Post-Exploitation Impact: The incomplete chunk persists for 24 hours. The attacker repeats this process thousands of times, each time filling the temporary storage directory. Over time, the cumulative effect consumes available disk space, preventing legitimate users from uploading files, causing the CMS to fail when attempting to persist site data, and potentially rendering the content management system non-functional.

Scenario 2: Combined Low-Privilege Attack

A user with panel access but without file permissions could combine this vulnerability with legitimate CMS workflows to escalate the denial-of-service. Since the temporary storage exhaustion affects shared infrastructure, even users with legitimate upload permissions would be unable to complete their own file operations, amplifying the attacker's impact across the organization.

No public PoC is available at the time of this report; the attack chain is inferred from the vulnerability description and the known chunk upload mechanism design.

Impact Assessment

The business impact of CVE-2026-71415 is primarily characterized as a denial-of-service condition stemming from unauthorized resource consumption. Key impact vectors:

• Availability (HIGH): Repeated exploitation can fill the temporary storage directory (site/cache/.uploads), rendering the CMS unable to persist any data — files, site configuration, or content updates. This effectively halts all content operations on the instance.

• Confidentiality (LOW): The vulnerability does not provide read access to restricted content. The final permission checks prevent unauthorized files from reaching protected directories.

• Integrity (LOW): While unauthorized files cannot be written to content directories, the existence of stale chunk data in cache could potentially be leveraged in other attack chains, though no such interaction is currently known.

• Blast Radius: The attack requires a valid authenticated session with access.panel permission. This reduces the pool of potential attackers to existing users (internal threats, compromised low-privileged accounts). However, the storage exhaustion affects all users of the CMS, making the impact cross-user.

• CVSS Context: With no CVSS score assigned, the risk rating is incomplete. Based on the described characteristics (authenticated, high availability impact), a reasonable estimate would fall in the medium-to-high severity range, but this should not be treated as an official score.

• Targeted Systems: All Kirby CMS instances running versions 5.0.0 through 5.5.2 are affected. Instances without the Panel or REST API enabled are not exposed to this attack surface.

Detection Guidance

Sigma Rule

title: Kirby CMS Chunk Upload Authorization Bypass Attempt
id: 7c3a1f2e-8d4b-4a6c-9e1f-2b5d3c8a7f01
status: experimental
description: Detects attempted exploitation of CVE-2026-71415 where a low-privileged user submits chunk upload requests without proper authorization
author: valtersit.com Threat Intelligence
date: 2026/01/15
logsource:
  category: webserver
  product: apache
  detection:
    selection_upload_length:
      cs-method: POST
      cs-uri-query|contains: '/api/'
      sc-status: '200'
    selection_headers:
      cs-headers|contains: 'Upload-Length'
    filter_known_paths:
      cs-uri-query|contains:
        - '/content/'
        - '/site/accounts/'
    condition: selection_upload_length and selection_headers and not filter_known_paths
  level: medium
  tags:
    - attack.t1190
    - cve.2026-71415
    - cwe.862

YARA Rule

rule kirby_cve_2026_71415_chunk_upload_abuse {
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects patterns associated with chunked upload exploitation against Kirby CMS"
        cve = "CVE-2026-71415"
        date = "2026-01-15"
        severity = "medium"
    strings:
        $upload_length = "Upload-Length" ascii wide
        $process_chunk = "processChunk" ascii wide
        $cache_uploads = ".uploads" ascii wide
        $kirby_path = "site/cache" ascii wide
        $rest_endpoint = "/api/" ascii wide
    condition:
        (
            $upload_length and $cache_uploads and $rest_endpoint
        ) or (
            $process_chunk and $kirby_path
        )
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (
    msg:"KIRBY CMS CVE-2026-71415 Chunk Upload Authorization Bypass Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/api/";
    http.header_names; content:"Upload-Length";
    http.request_body; content!"data"; 
    classtype:attempted-dos;
    sid:202671415;
    rev:1;
    metadata:created_at 2026_01_15, cve CVE_2026_71415, cwe CWE_862;
)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where process.executable == "/usr/sbin/httpd" and
   network.protocol == "http" and
   destination.port == 80]
  [http where 
   http.request.method == "POST" and
   url.path startswith "/api/" and
   http.request.headers contains "Upload-Length" and
   url.path not startswith "/api/files"]

Splunk SPL Query

index=web sourcetype=access_combined status=200 method=POST
| where like(uri_path, "%/api/%")
| where like(headers, "%Upload-Length%")
| rename user as username
| stats count by username, src_ip, uri_path
| where count > 50
| eval suspicious="true"
| table _time, username, src_ip, uri_path, count
| sort - count

Wazuh OSSEC Rule

<rule id="202671" level="10">
  <decoded>apache-accesslog</decoded>
  <match>Upload-Length</match>
  <match>POST</match>
  <match>/api/</match>
  <description>Kirby CMS (CVE-2026-71415) chunk upload authorization bypass - repeated POST to /api/ with Upload-Length header</description>
  <group>web_application_attack,</group>
  <mitre>
    <id>T1190</id>
  </mitre>
</rule>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from tracked sources)

1. Immediate Mitigations:

   • Upgrade to 5.5.2 or later: The official fix is included in version 5.5.2. This is the only definitive remediation.
   • Disable the REST API if the organization does not rely on it for headless CMS operations. Set api => false in the Kirby configuration to reduce the attack surface.
   • Remove access.panel permission from user accounts that do not strictly require panel access. Only grant this permission to users who legitimately need the admin interface.
   • Monitor the site/cache/.uploads directory for unexpected growth. Implement automated alerts when directory size exceeds a threshold (e.g., 50MB).
   • Restrict upload storage via filesystem quotas or container-level storage limits to cap the blast radius of storage exhaustion attacks.

2. Patch/Upgrade Steps:

   • Back up the entire Kirby installation including the content, site, and media directories.
   • Update via Composer: composer update getkirby/cms to pull version 5.5.2.
   • Clear the cache directory (site/cache/) after upgrade to remove any stale chunk data.
   • Verify the upgrade by checking the installed version in kirby/composer.json or via the Panel's system information page.

3. Long-Term Hardening:

   • Implement least-privilege user management — audit all accounts with access.panel permission quarterly.
   • Deploy Web Application Firewall (WAF) rules that inspect chunked upload requests for anomalous Upload-Length declarations versus actual payload sizes.
   • Enable filesystem-level monitoring and alerting for unusual write patterns to cache directories.
   • Maintain a formal patch management SLA for CMS updates, with security patches treated as priority-one deployments.
   • Consider restricting the REST API to specific IP ranges or VPN for internal admin operations.

References

1. NVD Entry: https://nvd.nist.gov/vuln/detail/CVE-2026-71415
2. Kirby CMS Official Site: https://getkirby.com (consult the changelog for version 5.5.2)
3. CWE-862 Missing Authorization: https://cwe.mitre.org/data/definitions/862.html
4. CISA Known Exploited Vulnerabilities Catalog: https://www.cisa.gov/known-exploited-vulnerabilities-catalog (CVE-2026-71415 is NOT listed — no known exploitation evidence)

Threat Actor Campaigns: No known threat actor campaigns or exploit-in-the-wild activity have been identified for this CVE as of the publication date. No public PoC or exploit code is available. Organizations should treat this vulnerability as a credible internal-threat vector and low-privilege account compromise target, given the authenticated requirement and the ease of amplification once access is obtained.