Kirby CMS introduced a performance improvement in version 5.3.0 that loads user objects lazily and queries users by ID to locate account directories under site/accounts. However, the user ID input was not properly validated, leading to a path traversal vulnerability (CWE-22) that allows attackers to include arbitrary PHP files named index.php from unintended directories. This affects unauthenticated access to the authentication API and authenticated access to the users API, as well as any code using $users->find() with user-provided IDs or emails. Attackers can also enumerate directories on the server to fingerprint the environment. The vulnerability is resolved in version 5.4.1.

An attacker can exploit this vulnerability to include arbitrary PHP files named index.php, potentially executing malicious code depending on the included file's logic. Additionally, the attacker can probe for the existence of arbitrary directories on the server, gaining insight into the server's file structure, installed plugins, and content organization. This can lead to further targeted attacks or information disclosure. The vulnerability is remotely exploitable without authentication in some cases (authentication API) and with authentication in others (users API).

A fix for this vulnerability is available in Kirby version 5.4.1. Users should upgrade to version 5.4.1 or later to remediate this issue. Since the vendor advisory indicates the issue is fixed in 5.4.1, no additional mitigation steps are required beyond applying this update.