CVE-2020-26255 PHP Phar archives could be uploaded and executed in Kirby
Authenticated editors can upload and execute PHP Phar files, leading to remote code execution on the server.
- Exploited in the wild
- Not known
- Login needed
- An administrator
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-26255?
CVE-2020-26255 is a medium-severity vulnerability in getkirby kirby, published on 8 Dec 2020. An attacker needs administrator access to exploit it, with no action from the victim.
Official description
Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.
Weakness: CWE-434
Which versions are affected by CVE-2020-26255?
4 open source packages ship an affected version, including getkirby/cms and getkirby/panel. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
getkirby/cms Packagist | From 3.0.0 | 3.4.5 |
getkirby/cms Packagist | From 3.0.0 | 3.4.5 |
getkirby/panel Packagist | All versions | 2.5.14 |
getkirby/panel Packagist | All versions | 2.5.14 |
Products include Getkirby Kirby, Getkirby Panel.
How do I fix CVE-2020-26255?
Upgrade getkirby/cms to 3.4.5 or later.
Is CVE-2020-26255 being exploited?
There is no known exploitation of CVE-2020-26255 in the wild and no public exploit code.
Other vulnerabilities in getkirby kirby
- CVE-2024-26483 Kirby vulnerable to unrestricted file upload of user avatar images
- CVE-2024-41964 Insufficient permission checks in the language settings in Kirby CMS
- CVE-2026-34587 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
- CVE-2021-29460 Cross-site scripting (XSS) from unsanitized uploaded SVG files
- CVE-2023-38489 Kirby vulnerable to Insufficient Session Expiration after a password change
Sources
Also known as GHSA-g3h8-cg9x-47qw.