We’re taking on a small number of new builds and rebuilds this quarter. Book a call to see if your project is a fit.

CVE CVE-2026-29905

CVE-2026-29905

PHP

Severity: MEDIUM
CVSS: 6.5CVSS
Published: 2026-03-26
Last modified: 2026-03-26
CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
CWE: CWE-20CWE-252

Description

Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.

References

https://drive.google.com/file/d/1MwvvSYIwnC8kOIzjycGMQZw4d2K2ef8h/view?usp=sharing
https://github.com/Stalin-143/CVE-2026-29905
https://github.com/getkirby/kirby/releases/tag/5.2.0-rc.1

Summary

Description

References