CVE-2025-30159 is a path traversal vulnerability affecting the Kirby open-source content management system (CMS) in versions prior to 3.9.8.3, between 3.10.0 and 3.10.1.2, and between 4.0.0 and 4.7.1. The vulnerability arises from improper validation of dynamic snippet names passed to the `snippet()` helper or `$kirby->snippet()` method. When these snippet names are constructed dynamically based on user input or request parameters without proper sanitization, an attacker can manipulate the snippet path to traverse directories outside the intended snippets root. This allows unauthorized access to arbitrary files on the server that the PHP process can read, including files outside the Kirby installation directory. Furthermore, if the accessed files contain PHP code, this code can be executed, leading to potential remote code execution. Exploitation requires the presence of dynamic snippet calls in the site code (e.g., `snippet('tags-' . get('tags'))`), knowledge or discovery of the server’s file system structure, and no authentication or user interaction is needed. The vulnerability has been addressed in Kirby versions 3.9.8.3, 3.10.1.2, and 4.7.1 by implementing strict path validation to ensure snippet paths remain within the configured snippets root directory. The CVSS 4.0 base score is 6.3 (medium severity), reflecting network exploitability without privileges or user interaction, with limited impact on confidentiality and integrity and no impact on availability. No known exploits are reported in the wild as of the publication date.

For European organizations using vulnerable versions of Kirby CMS with dynamic snippet calls, this vulnerability poses a significant risk to server confidentiality and integrity. Attackers could access sensitive configuration files, source code, or other protected data, potentially leading to data breaches or intellectual property theft. Execution of arbitrary PHP code could allow attackers to escalate privileges, implant backdoors, or pivot within the network, increasing the risk of broader compromise. Organizations relying on Kirby for public-facing websites or internal portals may face reputational damage, regulatory penalties under GDPR if personal data is exposed, and operational disruptions. The lack of required authentication or user interaction lowers the barrier for exploitation, increasing the threat level. However, the requirement for dynamic snippet usage and some knowledge of the server environment somewhat limits the attack surface. Still, automated scanning or fuzzing could identify vulnerable setups, making widespread exploitation feasible if patches are not applied promptly.

European organizations should immediately audit their Kirby CMS installations to identify versions prior to 3.9.8.3, between 3.10.0 and 3.10.1.2, and between 4.0.0 and 4.7.1. They must upgrade to the patched versions (3.9.8.3, 3.10.1.2, or 4.7.1) without delay. Additionally, developers should review all uses of the `snippet()` helper or `$kirby->snippet()` method to eliminate dynamic snippet names derived from user input or untrusted sources. Where dynamic snippets are necessary, implement rigorous input validation and sanitization to prevent path traversal characters or sequences. Employ web application firewalls (WAFs) with custom rules to detect and block suspicious requests attempting directory traversal patterns targeting snippet parameters. Conduct regular code reviews and penetration testing focusing on dynamic file inclusion points. Restrict PHP process permissions to the minimum necessary, limiting file system access to reduce potential damage from exploitation. Finally, monitor logs for anomalous access patterns or errors related to snippet loading to detect attempted exploitation attempts early.