CVE-2026-29905: Kirby CMS DoS Vulnerability via Upload

CVE-2026-29905 Overview

CVE-2026-29905 is a Denial of Service (DoS) vulnerability affecting Kirby CMS through version 5.1.4. The vulnerability allows an authenticated user with 'Editor' permissions to cause a persistent denial of service condition by uploading a malformed image file. The application fails to properly validate the return value of the PHP getimagesize() function, which can return false for invalid image files. When the system subsequently attempts to process this malformed file for metadata extraction or thumbnail generation, it triggers a fatal TypeError that crashes the application.

Critical Impact

Authenticated attackers with Editor-level access can persistently disrupt Kirby CMS availability by uploading specially crafted image files that trigger fatal PHP errors during processing.

Affected Products

• Kirby CMS versions through 5.1.4

Discovery Timeline

• 2026-03-26 - CVE-2026-29905 published to NVD
• 2026-03-26 - Last updated in NVD database

Technical Details for CVE-2026-29905

Vulnerability Analysis

This vulnerability stems from improper input validation (CWE-20) in Kirby CMS's image handling functionality. When a user with Editor permissions uploads an image file, the application uses PHP's getimagesize() function to extract image dimensions and metadata. The getimagesize() function returns an array containing image properties on success, but returns false when the file is not a valid image or cannot be processed.

The vulnerable code path does not properly check for the false return value before attempting to use the result as an array. When a malformed image file is uploaded, the subsequent array access operations on the boolean false value trigger a PHP TypeError. This error is fatal and causes the application to crash, resulting in a denial of service condition.

The impact is persistent because the malformed file remains on the server and can trigger the error each time the CMS attempts to regenerate thumbnails or access image metadata, effectively making portions of the content management system unusable until the offending file is manually removed.

Root Cause

The root cause is insufficient validation of the return value from PHP's getimagesize() function. The application assumes this function will always return valid image dimension data without implementing proper error handling for cases where the function returns false due to invalid or corrupted image files. This represents a classic improper input validation flaw where user-supplied data (the uploaded file) is not adequately verified before being processed.

Attack Vector

The attack requires network access and low-privilege authentication (Editor role). An attacker must first authenticate to the Kirby CMS panel with at least Editor permissions. They can then upload a specially crafted file with an image extension that is not actually a valid image format, or a corrupted image file that causes getimagesize() to fail.

Once uploaded, the malicious file triggers the vulnerability whenever:

• The CMS generates thumbnails for the panel or frontend
• Media metadata is accessed or indexed
• The file browser renders previews

The vulnerability does not require user interaction beyond the initial upload, and the denial of service persists until administrative intervention removes the malformed file.

Detection Methods for CVE-2026-29905

Indicators of Compromise

• PHP fatal error logs showing TypeError exceptions related to image processing or getimagesize() function calls
• Uploaded files in Kirby's content folders with image extensions but invalid or corrupted image headers
• Repeated 500 Internal Server Error responses when accessing pages or panel sections that reference specific media files
• Web server error logs indicating PHP crashes during thumbnail generation or media metadata retrieval

Detection Strategies

• Monitor PHP error logs for fatal TypeError exceptions involving array operations on boolean values in image processing contexts
• Implement file integrity monitoring to detect uploaded files that do not match their declared MIME types
• Set up alerting for unusual patterns of file uploads from Editor accounts, particularly files that immediately cause processing errors
• Review access logs for Editor users uploading files followed by application errors

Monitoring Recommendations

• Configure centralized logging for PHP fatal errors and correlate with user session data to identify potential attack sources
• Implement real-time monitoring for Kirby CMS panel availability and functionality
• Track server error rates and set threshold alerts for sudden increases in 500-series HTTP responses
• Monitor file upload endpoints for suspicious activity patterns from authenticated sessions

How to Mitigate CVE-2026-29905

Immediate Actions Required

• Upgrade Kirby CMS to version 5.2.0 or later, which contains the security fix for this vulnerability
• Review and audit recently uploaded media files for any that may have been maliciously crafted
• Temporarily restrict Editor permissions for untrusted users until the patch is applied
• Monitor error logs for signs of exploitation attempts or persistent DoS conditions

Patch Information

The Kirby development team has addressed this vulnerability in version 5.2.0. The fix implements proper validation of the getimagesize() return value before attempting to process image metadata. Organizations running affected versions should upgrade to 5.2.0-rc.1 or later as documented in the Kirby 5.2.0 Release Notes.

Additional technical details about the vulnerability may be found in the CVE-2026-29905 PoC repository and the associated documentation.

Workarounds

• Implement server-side file validation at the web server level to verify image headers before allowing uploads to reach the application
• Configure PHP error handling to catch TypeError exceptions gracefully instead of causing fatal crashes
• Limit Editor account access to trusted personnel only until the patch can be applied
• Consider implementing a Web Application Firewall (WAF) rule to inspect uploaded files for valid image signatures