Kirby CMS introduced a performance optimization in version 5.3.0 that lazily loads user objects by querying user IDs to locate account directories under site/accounts. However, the user ID input was not properly validated, leading to a path traversal vulnerability (CWE-22) that could be exploited via unauthenticated or authenticated API endpoints. This allowed attackers to include arbitrary PHP files named index.php from unintended directories and to enumerate directories on the server, revealing sensitive information about the site and plugins. The vulnerability was addressed and fixed in version 5.4.1.

An attacker can exploit this vulnerability to include arbitrary PHP files named index.php from directories outside the intended user account directories, potentially executing unintended code depending on the included file's logic. Additionally, attackers can probe the server's directory structure to fingerprint the site setup and installed plugins. This can lead to information disclosure and may facilitate further attacks. The vulnerability is remotely exploitable without authentication in some API endpoints.

This vulnerability has been fixed in Kirby CMS version 5.4.1. Users should upgrade to version 5.4.1 or later to remediate this issue. Patch status is confirmed by the vendor advisory indicating the fix in 5.4.1. No additional mitigation steps are indicated by the vendor.