Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
6.5

Kirby CMS: Authenticated Editor can Crash the Site with Malformed Image Uploads

CVE-2026-29905 · published 7 months ago
Summary

Authenticated users with Editor permissions can upload a special kind of image file that crashes the site. This can cause downtime and disrupt normal operations. Update to the latest version of Kirby CMS to prevent this issue.

What to do
  • Update getkirby cms to version 5.2.0-rc.1.
Affected software
Ecosystem VendorProductAffected versions
– getkirby kirby <= 5.1.4
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
composer getkirby cms < 5.2.0-rc.1
Fix: upgrade to 5.2.0-rc.1
Original advisory text
Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload
Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.
References
Fix within
Internet-facing 60 days
Internal At next upgrade
  • Not known to be exploited
  • Needs hands-on effort to exploit
  • Gives an attacker partial control
Severity
6.5 Medium
Exploitation
<1% chance of attack within 30 days
Type
CWE-20Improper Input Validation
CWE-252Unchecked Return Value
Timeline
Published26 Mar 2026
Updated4 Nov 2026
First seen26 Mar 2026
Sources
CVE-2026-29905 · NVD
GHSA-cw7v-45wm-mcf2 · GHSA
CVE-2026-29905 · OSV
Track software like this
Free during beta