CVE-2025-31493: Getkirby Kirby Path Traversal Flaw

CVE-2025-31493 Overview

CVE-2025-31493 is a path traversal vulnerability affecting Kirby, an open-source content management system. The vulnerability exists in the collection() helper and $kirby->collection() method when used with dynamic collection names that depend on request or user-supplied data. A missing path traversal check allows attackers to navigate outside the intended collections root directory and access arbitrary files on the server that are accessible to the PHP process.

Critical Impact

Attackers can read and potentially execute PHP code from any file accessible to the web server process, compromising the confidentiality and integrity of the entire server environment.

Affected Products

• Kirby versions prior to 3.9.8.3
• Kirby versions prior to 3.10.1.2
• Kirby versions prior to 4.7.1

Discovery Timeline

• 2025-05-13 - CVE-2025-31493 published to NVD
• 2025-08-26 - Last updated in NVD database

Technical Details for CVE-2025-31493

Vulnerability Analysis

This path traversal vulnerability (CWE-22) specifically impacts Kirby CMS installations that utilize dynamic collection names in their site code. The vulnerability requires an attack vector within the site's implementation where user-controlled input influences the collection name parameter. While sites using fixed, hardcoded collection names remain unaffected, those incorporating request parameters or user data into collection names are vulnerable to exploitation.

The attack surface is constrained by several factors: the attacker must first identify a vulnerable code pattern in the target site, possess knowledge of the server's file system structure, and understand the Kirby installation layout. However, automated discovery techniques such as fuzzing can potentially identify vulnerable configurations without extensive prior knowledge.

Root Cause

The root cause of this vulnerability is the absence of proper path validation in Kirby's collection loading mechanism. When processing collection requests, the CMS failed to verify that the resolved file path remained within the configured collections root directory. This oversight allowed specially crafted input containing directory traversal sequences (such as ../) to escape the intended directory boundary and reference files elsewhere on the file system.

Attack Vector

The attack exploits dynamic collection name handling where user input is concatenated into the collection path. When a vulnerable pattern exists, such as collection('tags-' . get('tags')), an attacker can manipulate the tags parameter to include path traversal sequences. By supplying a crafted value containing multiple ../ sequences, the attacker can navigate the file system hierarchy and access sensitive files outside the collections directory.

The network-based attack requires no authentication and can be executed remotely. Once a vulnerable endpoint is identified, the attacker can potentially:

1. Read configuration files containing database credentials or API keys
2. Access application source code revealing business logic
3. Execute arbitrary PHP code if the attacker can control the content of an accessible PHP file
4. Compromise other applications hosted on the same server

Detection Methods for CVE-2025-31493

Indicators of Compromise

• HTTP requests containing ../ or URL-encoded variants (%2e%2e%2f, %2e%2e/) in query parameters that feed collection names
• Access logs showing unusual patterns targeting collection-related endpoints with traversal sequences
• File access logs indicating PHP reading files outside the Kirby collections directory
• Error logs showing failed attempts to access non-existent files outside the web root

Detection Strategies

• Implement Web Application Firewall (WAF) rules to detect and block path traversal patterns in request parameters
• Monitor application logs for requests containing directory traversal sequences targeting Kirby endpoints
• Deploy file integrity monitoring on sensitive configuration files and directories outside the web root
• Use runtime application self-protection (RASP) solutions to detect path traversal attempts at the application layer

Monitoring Recommendations

• Enable verbose logging for the Kirby CMS application to capture collection loading events
• Configure alerting for any file access attempts originating from the web server process targeting files outside expected directories
• Implement anomaly detection for request patterns that include encoded special characters in collection-related parameters
• Review web server access logs regularly for reconnaissance or exploitation attempts

How to Mitigate CVE-2025-31493

Immediate Actions Required

• Update Kirby CMS to version 3.9.8.3, 3.10.1.2, or 4.7.1 depending on your current major version
• Audit site code for dynamic collection name usage and identify vulnerable patterns
• Implement input validation to sanitize user-supplied data before use in collection names
• Restrict PHP process file system permissions to limit accessible files

Patch Information

The Kirby maintainers have released security patches in versions 3.9.8.3, 3.10.1.2, and 4.7.1. These updates add a path containment check that verifies the resolved collection path remains within the configured collections root directory. Collection paths that attempt to reference files outside this boundary are rejected and will not be loaded.

For detailed patch information, refer to the GitHub Security Advisory GHSA-x275-h9j4-7p4h and the respective release notes:

• Kirby 3.9.8.3 Release
• Kirby 3.10.1.2 Release
• Kirby 4.7.1 Release

Workarounds

• Replace dynamic collection names with fixed, hardcoded collection name strings where possible
• Implement strict allowlist validation for any user input used in collection names, accepting only known-safe values
• Use PHP's realpath() function to resolve and validate paths before passing them to the collection helper
• Deploy a WAF with path traversal protection rules as a temporary defense layer while planning the upgrade

# Configuration example - verify Kirby version after update
php -r "echo Kirby\\Cms\\App::version();"

# Check for vulnerable patterns in your codebase
grep -r "collection(.*\$" site/templates/ site/controllers/ site/snippets/