CVE-2026-75594

Executive Summary

CVE-2026-75594 is a path traversal vulnerability in Kirby, an open-source content management system. Affecting versions prior to 4.9.5 and 5.5.2, the flaw resides in the media handler, specifically in the Kirby\Cms\Media::thumb() method, which fails to properly sanitize path-bearing filenames before appending them to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote unauthenticated attacker can submit encoded slash characters (e.g., %2f) to traverse outside the intended media directory. The same flaw lineage extends to the file::version path in src/Filesystem/Asset.php, which accepts ../ sequences outside the intended index root. Exploitation enables directory traversal, potential disclosure of arbitrary .json files, and deletion of job files within the media directory tree.

Technical Analysis

The vulnerability stems from improper input validation in Kirby's media handling logic. The core issue resides in src/Cms/Media.php, where the Kirby\Cms\Media::thumb() method processes filenames to generate thumbnail versions of media assets. The method validates the parent media directory but fails to adequately sanitize the filename component before appending it to the validated path. This allows a filename containing path traversal sequences — including encoded slashes such as %2f — to escape the intended directory boundary.

The exploitation conditions are server-configuration dependent. On nginx, PHP's built-in development server, or Apache configurations with AllowEncodedSlashes enabled, the web server will decode %2f sequences into forward slashes before passing the request to the application. This decoded path traversal sequence then bypasses the directory validation performed by Media::thumb().

The vulnerability manifests as an oracle-based information disclosure. Because the media handler processes filenames differently depending on whether a corresponding thumbnail configuration exists, an attacker can differentiate between responses for existing versus nonexistent thumbnail configuration files. This discrepancy discloses whether an arbitrary .json file exists within the traversed path. Furthermore, if a .json file containing a valid filename key is encountered, the media handler will return the referenced image content and delete the job file, allowing both data retrieval and file deletion.

A parallel flaw exists in src/Filesystem/Asset.php along the file::version path. This component accepts ../ sequences that escape the intended index root, suggesting incomplete path normalization across multiple file-handling components in the same codebase. The presence of two independently vulnerable file-processing paths indicates a systemic weakness in Kirby's input validation strategy for file operations.

The attack surface is the HTTP-accessible media handling endpoint, which is typically reachable without authentication in Kirby's default configuration. No authentication is required to trigger the vulnerable code path, making this an externally exploitable flaw in default deployments.

Exploitation Scenarios

Step 1: Reconnaissance and Target Identification. An attacker identifies Kirby-powered websites by probing for distinctive paths such as /media, /panel, or Kirby-specific HTTP response headers. The attacker fingerprints the server software (nginx, PHP built-in server, or Apache with AllowEncodedSlashes) since exploitation requires server-side decoding of encoded slashes.

Step 2: Triggering the Vulnerability. The attacker submits a crafted HTTP request to the media handler endpoint with a filename parameter containing URL-encoded path traversal sequences. The payload leverages %2f (encoded forward slash) combined with ../ sequences to traverse outside the validated media parent directory. For example, a request path resembling media/test.jpg/thumb %2f..%2f..%2fconfig%2fconfig.json would be decoded by the server and processed by Kirby\Cms\Media::thumb().

Step 3: Vulnerability-Class Payload Execution. At the vulnerability-class level (CWE-22 — Path Traversal), the attacker exploits the absence of proper input validation to navigate the filesystem outside the intended media root. The media handler processes the path-bearing filename and attempts to resolve it relative to the validated parent directory, ultimately accessing files outside that boundary. The attacker performs a two-phase attack: first, probing for the existence of specific .json files by observing differential responses based on thumbnail configuration existence; second, retrieving the contents of located .json files or triggering the deletion of job files when a valid filename key is present.

Step 4: Post-Exploitation Impact. Successful exploitation results in unauthorized file disclosure — specifically .json files that may contain configuration data, user credentials, or application secrets. The deletion capability enables an attacker to remove arbitrary job files, potentially causing denial of service or disrupting application functionality. The disclosed configuration data may facilitate further attacks, including privilege escalation or lateral movement within the infrastructure.

No public PoC is available for this vulnerability; the attack chain is inferred from the vulnerability class and behavior described in the advisory.

Impact Assessment

The impact of CVE-2026-75594 is moderate-to-high depending on deployment context. The vulnerability allows unauthenticated remote attackers to traverse outside the media directory and access arbitrary .json files on the server, potentially exposing sensitive configuration data including database credentials, API keys, and application secrets. The differential response behavior provides a reliable existence oracle for arbitrary .json files, enabling systematic reconnaissance of the server filesystem.

The file deletion capability introduces an integrity impact, allowing attackers to remove job files which may be part of Kirby's background processing workflow. Depending on the files targeted, this could disrupt content publishing, image processing, or other automated tasks, resulting in availability degradation.

Kirby is widely deployed as a flat-file CMS for websites, portfolios, and small to medium business sites. The attack surface is public-facing media endpoints, which are enabled by default. Organizations running affected versions on nginx, PHP's built-in server, or Apache with AllowEncodedSlashes are at immediate risk. The CVSS score for this vulnerability is not yet assigned (N/A), and EPSS scoring is pending FIRST.org analysis.

The combination of information disclosure and file deletion in a single unauthenticated vector elevates the risk profile, particularly for high-value targets where configuration disclosure could lead to full compromise.

Detection Guidance

Sigma Rule

title: Kirby CMS Path Traversal via Encoded Slashes in Media Handler
id: 5f7a9c2e-84d1-4b6a-9e3f-2c8d5a7b1e04
status: experimental
description: Detects attempts to exploit CVE-2026-75594 in Kirby CMS by identifying path traversal patterns with encoded slashes in media handler requests.
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-75594
tags:
    - attack.t1190
    - cve.2026.75594
    - cwe.22
logsource:
    category: webserver
    product: nginx|apache
detection:
    selection_path:
        cs-uri-query|contains:
            - '%2f%2e%2e'
            - '%2f..'
            - '..%2f'
            - '%2e%2e%2f'
            - '%252e%252e%252f'
        cs-uri-path|contains:
            - '/media/'
    selection_server:
        cs-host|contains:
            - 'kirby'
            - 'cms'
    condition: selection_path and selection_server
falsepositives:
    - Legitimate URI encoding in content management workflows
    - CDN or caching layers performing URL normalization
level: high

YARA Rule

rule Kirby_CVE_2026_75594_PathTraversal
{
    meta:
        author = "valtersit.com Threat Intelligence"
        description = "Detects payload patterns for Kirby CMS media handler path traversal (CVE-2026-75594)"
        date = "2026-01-01"
        cve = "CVE-2026-75594"
        severity = "high"
    strings:
        $traversal1 = "%2f..%2f"
        $traversal2 = "%2f%2e%2e%2f"
        $traversal3 = "..%2f"
        $traversal4 = "%2e%2e%2f"
        $double_encoded = "%252e%252e%252f"
        $media_path = "/media/"
        $json_ext = ".json"
        $thumb_param = "thumb"
        $job_pattern = /job[_-]{1}[a-zA-Z0-9]+\.json/
    condition:
        uint16(0) == 0x0a0d and
        any of ($traversal*) and
        ($media_path or $thumb_param) and
        ($json_ext or $job_pattern)
}

Suricata IDS Rule

alert http any any -> $HOME_NET any (msg:"KIRBY-CMS CVE-2026-75594 Path Traversal Attempt"; flow:established,to_server; content:"/media/"; http_uri; content:"%2f"; http_uri; content:".."; http_uri; within:20; pcre:"/(?:%2f|%2e|\.\.)+/i"; classtype:web-application-attack; reference:cve,2026-75594; sid:2026001; rev:1;)

Elastic Detection

sequence by source.ip with maxspan=5m
  [network where event.category == "web" and process.name == "nginx"]
  [http where event.category == "web" and http.request.method == "GET" or http.request.method == "POST"
   and http.request.uri contains "/media/" 
   and (http.request.uri contains "%2f" or http.request.uri contains ".." )]

Splunk SPL Query

index=web sourcetype=access_combined uri_path="/media/*"
| eval has_encoded_slash=if(uri LIKE "%2f%",1,0)
| eval has_dots=if(uri LIKE "%..%",1,0)
| eval has_traversal=if(uri LIKE "%.json%",1,0)
| where has_encoded_slash=1 AND has_dots=1
| eval traversal_pattern=case(
    uri LIKE "%2f%2e%2e%" OR uri LIKE "%2f..%" OR uri LIKE "%252e%252e%" , "encoded-path-traversal",
    1=1, "suspicious-request")
| where traversal_pattern="encoded-path-traversal"
| stats count by src_ip, uri, http_user_agent, status
| where count > 3
| table _time, src_ip, uri, status, http_user_agent, count

Wazuh OSSEC Rule

<group name="web, attack, cve,">
  <rule id="108910" level="12">
    <decoded_as>web</decoded_as>
    <match>%2f</match>
    <match>..</match>
    <regex>\/media\/.*(?:%2f|\.\.)</regex>
    <description>CVE-2026-75594 - Kirby CMS media handler path traversal attempt detected (encoded slash + traversal sequence)</description>
    <group>web_application_attack</group>
    <status>enabled</status>
    <mitre>
      <id>T1190</id>
    </mitre>
    <options>no_full_log</options>
    <alert_email>soc@valtersit.com</alert_email>
  </rule>
</group>

Mitigation & Patch Guidance

Patch Confidence: 0/4 — UNPATCHED (no patch evidence from tracked sources; vendor fix versions identified as 4.9.5 and 5.5.2)

1. Immediate Mitigations (do these now):

   • Upgrade Kirby to version 4.9.5 (for the 4.x release line) or 5.5.2 (for the 5.x release line) as soon as vendor packages become available.
   • If immediate upgrade is not possible, harden the web server configuration:
     • On Apache, ensure AllowEncodedSlashes is set to Off (the default) for Kirby virtual hosts.
     • On nginx, implement a location block that rejects requests containing encoded slash sequences (%2f, %2F) before they reach the PHP handler.
     • For PHP's built-in server, discontinue use in production environments.
   • Implement a Web Application Firewall (WAF) rule to block requests containing /media/ combined with %2f or .. traversal patterns.
   • Restrict access to the /media/ directory via web server ACLs if public media access is not required.

2. Patch/Upgrade Steps:

   • Monitor Kirby's official release channels and security advisories for updated package distributions.
   • Test the upgrade in a staging environment before production deployment.
   • Verify the upgrade by re-running all media operations and confirming thumbnail generation works as expected.
   • Validate the fix by attempting the traversal payload against upgraded instances.

3. Long-Term Hardening:

   • Conduct a comprehensive code audit of all file-handling components within the deployment to identify similar path traversal vectors.
   • Enforce decode-once policies at the web server level to prevent double-encoding bypasses.
   • Adopt a security-by-default approach by explicitly validating and canonicalizing all filenames before filesystem operations.
   • Implement centralized logging and monitoring for all media endpoint access, with alerting on anomalous traversal patterns.
   • Subscribe to Kirby's security mailing list and monitor NVD for related CVE disclosures.
   • Consider deploying a containerized or isolated execution environment for the CMS to limit filesystem blast radius in the event of future compromise.

References

1. NVD — CVE-2026-75594: https://nvd.nist.gov/vuln/detail/CVE-2026-75594
2. Kirby CMS Official Website / Security Advisories: https://getkirby.com/security
3. CWE-22 — Improper Limitation of a Pathname to a Restricted Directory: https://cwe.mitre.org/data/definitions/22.html
4. MITRE ATT&CK — T1190 Exploit Public-Facing Application: https://attack.mitre.org/techniques/T1190/

Threat Actor Campaigns and Exploit-in-the-Wild Evidence: No known active exploitation campaigns or exploit-in-the-wild evidence have been reported for CVE-2026-75594 at the time of writing. The CISA KEV catalog does not list this CVE. The vulnerability is newly disclosed with patch confidence rated at 0/4, meaning patch validation is pending. Organizations should prioritize monitoring and detection despite the absence of confirmed in-the-wild exploitation.