Answer in brief
CVE-2026-75594 records a High severity vulnerability in Kirby: Access to image files and limited access to JSON files outside of the site root via path traversal in the media handling. The current sources do not mark it as known exploited. The current feed maps getkirby/cms (composer), getkirby/cms (composer), getkirby/kirby (generic). Check affected ranges and fixed versions before updating.
Analysis pending evidence review
HOL Guard separates source facts from reviewed analysis. See the methodology.
A CVSS score is not reported in the current record. The current sources do not mark it as known exploited. Treat this as a source-backed prioritization signal, not a statement about your environment.
Analysis status
Analysis pending evidence review
Factual feed record only; HOL analysis is not approved for indexing. Read the methodology.
The current feed maps getkirby/cms (composer), getkirby/cms (composer), getkirby/kirby (generic). Check affected ranges and fixed versions before updating.
| Package | Affected range | Fixed version |
|---|---|---|
| getkirby/cmscomposer | <=4.9.4 | 4.9.5 |
| getkirby/cmscomposer | >=5.0.0,<5.5.2 | 5.5.2 |
| getkirby/kirbygeneric | < 4.9.5 || >= 5.0.0, < 5.5.2 | Not reported |
Published upstream
Aug 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordSource modified
Aug 31, 2026
Evidence: source:cvelist:source_dates:source-dates:recordFirst seen by HOL
Aug 31, 2026
Kirby is an open-source content management system. Prior to 4.9.5 and 5.5.2, depending on the release line, Kirby's media handler in src/Cms/Media.php allowed Kirby\Cms\Media::thumb() to append a path-bearing filename to a validated parent media directory. On nginx, PHP's built-in server, or Apache with AllowEncodedSlashes enabled, a remote attacker could submit encoded slash characters such as %2f in the filename and traverse outside the parent's media directory. Differences between responses for existing and nonexistent thumbnail configurations disclosed whether an arbitrary .json file existed, and a .json file containing a valid filename key could cause the referenced image to be returned and the job file to be deleted. The related file::version path in src/Filesystem/Asset.php also accepted ../ sequences outside the intended index root. This issue is fixed in versions 4.9.5 and 5.5.2.
Quoted source text, attributed separately from HOL analysis.