CVE-2026-75594: CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') in getkirby kirby

Kirby's media handler in src/Cms/Media.php improperly limits pathname traversal in the Media::thumb() function, allowing path-bearing filenames with encoded slashes (e.g., %2f) to escape the validated parent media directory on nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled. This leads to directory traversal outside the media directory. Additionally, differences in server responses reveal the existence of arbitrary .json files, and if a .json file contains a valid filename key, it can cause an image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepts ../ sequences outside the intended index root. The vulnerability is addressed in Kirby versions 4.9.5 and 5.5.2.

An unauthenticated remote attacker can exploit this vulnerability to traverse directories outside the intended media directory, potentially accessing or deleting arbitrary files such as .json job files. This can lead to unauthorized information disclosure and file manipulation. The CVSS 4.0 score is 8.2 (high severity), indicating a significant risk if exploited.

This vulnerability is fixed in Kirby versions 4.9.5 and 5.5.2. Users should upgrade to these or later versions to remediate the issue. Patch status is not explicitly stated beyond the fixed versions; therefore, verify with the vendor advisory for the latest remediation guidance.