CVE-2026-71415
CVE-2026-71415 · Kirby: File upload permissions are not checked during processing of chunk data
Здесь приведены факты из открытых источников об уязвимостях. Перед обновлением ознакомьтесь с исходным сообщением.
Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.
CVSS 7.1 · Высокий · EPSS 0,4% · Есть исправление
- Опубликовано
- Обновлено
Стек: php
Затронутые продукты и версии
kirby
- Версии
- >= 5.0.0, < 5.5.2: Затронуто
Нет опубликованного исправления
getkirby/cms Packagist
- Версии
- 5.0.0
- 5.0.1
- 5.0.2
- 5.0.3
- 5.0.4
- 5.1.0
- 5.1.0-rc.1
- 5.1.1
- 5.1.2
- 5.1.3
- 5.1.4
- 5.2.0
- 5.2.0-rc.1
- 5.2.1
- 5.2.2
- 5.2.3
- 5.3.0
- 5.3.0-rc.1
- 5.3.1
- 5.3.2
- 5.3.3
- 5.4.0
- 5.4.1
- 5.4.2
- 5.4.3
- 5.4.4
- 5.5.0
- 5.5.1
- Затронутые диапазоны версий
- ECOSYSTEM: ≥ 5.0.0, < 5.5.2
Обновитесь до 5.5.2