CVE-2026-71415: CWE-862: Missing Authorization in getkirby kirby

From versions 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler (src/Api/Upload.php) failed to perform the necessary upload authorization preflight in Kirby\Api\Upload::process() before persisting chunk data in Kirby\Api\Upload::processChunk(). An authenticated user with access.panel permission but without files.create, files.replace, or user/users.update permissions could submit chunked upload requests with an Upload-Length header, leaving unfinished chunks in site/cache/.uploads for 24 hours. Repeated exploitation could consume temporary storage, potentially preventing other users from uploading files or interfering with site logic that stores data. However, final permission checks still prevented unauthorized files from being saved in content or site/accounts directories. The vulnerability is fixed in version 5.5.2.

An attacker with limited authenticated access can cause resource exhaustion by leaving unfinished upload chunks in temporary storage, potentially disrupting legitimate file uploads and site data storage. There is no direct unauthorized file creation or modification in protected directories due to final permission checks. The impact is denial of service related to storage consumption.

A fix is available in Kirby version 5.5.2. Users should upgrade to version 5.5.2 or later to resolve this issue. No other specific mitigations are indicated.