getkirby Kirby up to 5.5.1 REST API chunk upload handler src/Api/Upload.php processChunk Upload-Length improper authorization

Summaryinfo

A vulnerability described as problematic has been identified in getkirby Kirby up to 5.5.1. The affected element is the function Kirby\Api\Upload::processChunk of the file src/Api/Upload.php of the component REST API chunk upload handler. The manipulation of the argument Upload-Length results in improper authorization. This vulnerability was named CVE-2026-71415. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability classified as problematic has been found in getkirby Kirby up to 5.5.1. Affected is the function Kirby\Api\Upload::processChunk of the file src/Api/Upload.php of the component REST API chunk upload handler. The manipulation of the argument Upload-Length with an unknown input leads to a improper authorization vulnerability. CWE is classifying the issue as CWE-285. The product does not perform or incorrectly performs an authorization check when an actor attempts to access a resource or perform an action. This is going to have an impact on integrity, and availability. CVE summarizes:

Kirby is an open-source content management system. From 5.0.0 until 5.5.2, Kirby's REST API chunk upload handler in src/Api/Upload.php did not run the relevant upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persisted chunk data. An authenticated user with the access.panel permission enabled but with files.create, files.replace, and user/users.update permissions disabled could submit requests with an Upload-Length header and leave unfinished chunks in site/cache/.uploads for 24 hours. Repeating this process could consume attacker-controlled temporary storage, prevent other users from uploading files, or prevent site logic from storing data, although final permission checks still prevented unauthorized files from reaching the content or site/accounts directories. This issue is fixed in version 5.5.2.

The advisory is available at github.com. This vulnerability is traded as CVE-2026-71415 since 08/06/2026. The exploitability is told to be easy. It is possible to launch the attack remotely. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1548.002 by the MITRE ATT&CK project.

By approaching the search of inurl:src/Api/Upload.php it is possible to find vulnerable targets with Google Hacking.

Upgrading to version 5.5.2 eliminates this vulnerability.

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• getkirby

Name

• Kirby

Version

• 5.5.0
• 5.5.1

Website

• Product: https://github.com/getkirby/kirby/

CPE 2.3info

• 🔒
• 🔒

CPE 2.2info

• 🔒
• 🔒

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion