CVE-2026-75594

### TL;DR This vulnerability affects all Kirby sites that are deployed to a server that allows requests for URLs with encoded slashes (`%2f`), such as nginx, PHP's built-in server or Apache setups that have the option `AllowEncodedSlashes` enabled. It was possible to create and access thumbnails from media files in arbitrary accessible directories on the server that have a valid thumbnail configuration (JSON job file). It was also possible to detect the presence of files with the `.json` file extension anywhere on the server. **This vulnerability is of high severity for affected sites.** Server setups using Apache's default configuration or other servers that have been hardened against encoded slashes in URLs are *not* affected. ---- ### Introduction A path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as `../`, an attacker can escape that directory and reach files elsewhere on the server. ### Affected components Kirby's media handler processes requests for files in the `media` directory that have not been generated yet. It parses the provided path and finds the correct file or asset from which to generate a thumbnail. Each thumbnail needs to have a prepared job file (a metadata file with file extension `.json`) in order to allow the media handler to generate it. Each parent (such as a page) has its own media directory, which in turn contains the individual files. Kirby's media handler searches for the file within the parent's media directory. ### Impact In affected releases, Kirby did not prevent path traversal in the filenames that were searched within the parent directory. In affected server setups where the attacker can provide encoded slashes (`%2f`) in the request, Kirby allowed the request to traverse away from the parent's media directory. Because the response differs between existing and non-existing thumbnail configurations, attackers were able to tell whether an arbitrary JSON file exists on the server (addressed by a relative path from the media directory of an arbitrary existing parent, including a relative path that points outside of the site's `index` root). For existing files with the file extension `.json` and a valid `filename` key (resulting in a valid job file), it was possible to generate thumbnails of the referenced media files, deleting the job file in the process. ### Patches The problem has been patched in [Kirby 4.9.5](https://github.com/getkirby/kirby/releases/tag/4.9.5) and [Kirby 5.5.2](https://github.com/getkirby/kirby/releases/tag/5.5.2). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability. In all of the mentioned releases, `Kirby\Cms\Media::thumb()` now rejects any filename that contains path information (anything other than a plain filename) before it is appended to the validated root. We have also hardened the `file::version` component to block paths that contain the `../` sequence. ### Credits Thanks to Jorge González Milla (@Pig-Tail) for responsibly reporting the identified issue.