CVE-2026-75592: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in getkirby kirby

Kirby CMS's media handler used insufficient checks in its filesystem path validation functions (Kirby\Filesystem\Dir::realpath() and Kirby\Filesystem\F::realpath()), which accepted sibling directories whose paths shared the intended root's string prefix without requiring an exact match or directory separator boundary. This flaw allowed remote attackers to leverage Kirby\Cms\Media::thumb() to create and access thumbnails from image files located in PHP-readable sibling directories if those directories contained valid .json thumbnail job files. This could expose staging sites, backups, or other internal sites and delete the job file during processing. The vulnerability is addressed in Kirby versions 4.9.5 and 5.5.2.

An unauthenticated remote attacker can exploit this vulnerability to access and create thumbnails from image files in sibling directories outside the intended root directory. This may lead to exposure of sensitive internal resources such as staging sites or backups. Additionally, the attacker can delete thumbnail job files during processing. The vulnerability does not require user interaction and has a medium severity rating with a CVSS 4.0 score of 6.9.

This vulnerability is fixed in Kirby versions 4.9.5 and 5.5.2. Users should upgrade to these versions or later to remediate the issue. No official patch or temporary workaround is provided in the advisory. Patch status is not yet confirmed beyond the fixed versions; check the vendor advisory for current remediation guidance.