CVE-2026-71415: Kirby CMS Chunk Upload DOS Vulnerability

CVE-2026-71415 Overview

CVE-2026-71415 is a missing authorization vulnerability [CWE-862] in Kirby, an open-source content management system. The flaw affects Kirby versions 5.0.0 through 5.5.1. The REST API chunk upload handler in src/Api/Upload.php fails to run the upload authorization preflight in Kirby\Api\Upload::process() before Kirby\Api\Upload::processChunk() persists chunk data. An authenticated user with limited Panel access can submit chunk upload requests that leave unfinished data in site/cache/.uploads for 24 hours. The issue is resolved in Kirby 5.5.2.

Critical Impact
Authenticated attackers with only access.panel permission can exhaust temporary storage, block legitimate uploads, and disrupt site logic that depends on the cache directory.

Affected Products

Kirby CMS versions 5.0.0 through 5.5.1
Kirby REST API chunk upload handler (src/Api/Upload.php)
Panel users lacking files.create, files.replace, and user/users.update permissions but retaining access.panel

Discovery Timeline

2026-08-31 - CVE-2026-71415 published to the National Vulnerability Database
2026-08-31 - Last updated in NVD database

Technical Details for CVE-2026-71415

Vulnerability Analysis

The vulnerability arises from an ordering flaw in Kirby's chunked upload processing. When a client submits a request containing the Upload-Length header, the API dispatches the request to Kirby\Api\Upload::processChunk(). That method writes chunk data to disk before Kirby\Api\Upload::process() performs its authorization preflight. As a result, an authenticated user without file creation or replacement permissions can still cause chunk fragments to be persisted in site/cache/.uploads. Kirby retains those unfinished chunks for 24 hours before cleanup. Final permission checks continue to block unauthorized files from reaching the content or site/accounts directories, so the impact is confined to storage exhaustion and denial of service.

Root Cause

The root cause is a missing authorization check [CWE-862] executed in the wrong order relative to persistence. The upload authorization preflight was intended to run before any chunk data touched the filesystem, but the code path invoked by Upload-Length requests skipped that check. This allowed writes into the cache directory without validating whether the requesting Panel user held files.create, files.replace, or user/users.update permissions.

Attack Vector

An attacker needs a valid Panel account with access.panel enabled. The attacker repeatedly issues chunk upload requests with an Upload-Length header and never completes them. Each unfinished session deposits chunk data in site/cache/.uploads that persists for 24 hours. Repeating the process consumes disk space, blocks legitimate users from uploading files, and can prevent site logic that depends on writing to the cache from functioning correctly.

php

// Security patch: config/api/routes/files.php
 <?php
 
+use Kirby\Cms\File;
+use Kirby\Exception\PermissionException;
+
 // routing pattern to match all models with files
 $filePattern   = '(account/|pages/[^/]+/|site/|users/[^/]+/|)files/(:any)';
 $parentPattern = '(account|pages/[^/]+|site|users/[^/]+)/files';

// Source: https://github.com/getkirby/kirby/commit/37e206f3ed40ad3fab2e47e055ccb19e9c207dab

The patch introduces PermissionException handling into the API route definitions so that authorization is enforced before chunk persistence occurs. A parallel change appears in config/api/routes/users.php.

Detection Methods for CVE-2026-71415

Indicators of Compromise

Unusual growth of files in the site/cache/.uploads directory without matching entries in the content tree
High volume of REST API requests containing the Upload-Length header from a single authenticated Panel user
Panel users with access.panel but no files.create or files.replace permissions issuing upload requests
Repeated incomplete chunk upload sessions that never reach a finalization request

Detection Strategies

Parse web server access logs for requests to Kirby API upload endpoints and correlate Upload-Length header usage with user role and outcome
Monitor filesystem size and file count in site/cache/.uploads and alert on abnormal growth rates
Audit Kirby Panel role assignments to identify accounts with access.panel but no upload permissions and review their API activity

Monitoring Recommendations

Establish baseline metrics for upload request volume per authenticated user and alert on statistical outliers
Forward Kirby application logs and web server logs into a centralized analytics platform for correlation and long-term retention
Configure disk usage alerts on the volume hosting site/cache to catch storage exhaustion before it affects site availability

How to Mitigate CVE-2026-71415

Immediate Actions Required

Upgrade Kirby to version 5.5.2 or later, which contains the authorization preflight fix
Review and purge stale entries in site/cache/.uploads after patching to reclaim consumed storage
Audit Panel user permissions and revoke access.panel from accounts that do not require it

Patch Information

The fix is included in Kirby 5.5.2. Refer to the GitHub Release 5.5.2 notes, the GitHub Security Advisory GHSA-67mx-6wf2-92xp, the corrective GitHub Pull Request #8296, and the underlying GitHub Commit Update for full technical detail.

Workarounds

Restrict Panel access to trusted users only until the upgrade is applied
Deploy a web application firewall rule to reject API upload requests containing an Upload-Length header from users who lack file creation permissions
Schedule frequent cleanup of the site/cache/.uploads directory to limit the impact of accumulated chunk data

bash

# Verify installed Kirby version and upgrade via Composer
composer show getkirby/cms
composer require getkirby/cms:^5.5.2

# Manually clear residual chunk uploads after patching
find ./site/cache/.uploads -type f -mmin +60 -delete