CVE-2026-29905 Denial of service in n/a
Authenticated editors can cause persistent denial of service in Kirby CMS by uploading malformed images that trigger fatal errors during processing.
- Exploited in the wild
- Not known
- Login needed
- Any signed-in user
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-29905?
CVE-2026-29905 is a medium-severity denial of service vulnerability in n/a, published on 26 Mar 2026. Any signed-in user can exploit it over the network, with no action from the victim.
Official description
Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.
Which versions are affected by CVE-2026-29905?
It affects 1 product.
Products include Getkirby Kirby.
How do I fix CVE-2026-29905?
No fix has been published for CVE-2026-29905 yet. Limit exposure of the affected software until one is available.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-29905 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2026-29905 exists.
Other vulnerabilities in n/a
- CVE-2024-26483 Kirby vulnerable to unrestricted file upload of user avatar images
- CVE-2024-41964 Insufficient permission checks in the language settings in Kirby CMS
- CVE-2026-34587 Kirby has Server-Side Template Injection (SSTI) via double template resolution in option rendering
- CVE-2021-29460 Cross-site scripting (XSS) from unsanitized uploaded SVG files
- CVE-2023-38489 Kirby vulnerable to Insufficient Session Expiration after a password change