CVE-2020-26255

Katalog CVE

CVSS 9.1 · Critical EPSS 1,5%

Kerentanan Unrestricted Upload of File with Dangerous Type pada getkirby kirby, getkirby panel. Skor CVSS 3.1 9.1 (Critical) menurut NVD.

Deskripsi (NVD)

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

Rincian

Terbit di NVD

8 Desember 2020

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

9.1 (Critical), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-434: Unrestricted Upload of File with Dangerous Type

EPSS (30 hari)

1,5% peluang dieksploitasi; lebih tinggi dari 73,3% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881 patch · advisory pihak ketiga
• https://github.com/getkirby/kirby/commit/db8f371b13036861c9cc5ba3e85e27f73fce5e09 patch · advisory pihak ketiga
• https://github.com/getkirby/kirby/releases/tag/3.4.5 release notes · advisory pihak ketiga
• https://github.com/getkirby/kirby/security/advisories/GHSA-g3h8-cg9x-47qw release notes · advisory pihak ketiga
• https://packagist.org/packages/getkirby/cms product · advisory pihak ketiga
• https://packagist.org/packages/getkirby/panel product · advisory pihak ketiga