Read the docs
TI-2020-16076 Aliases CVE-2020-26255GHSA-g3h8-cg9x-47qw

PHP Phar archives could be uploaded and executed in Kirby

Priority MEDIUM 42CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

Why it matters now

EPSS 0.01488 74th percentileScored 2026-11-07
Fix Fixed kirby (getkirby): 3.4.5getkirby/panel (Packagist): 2.5.14+1 more product

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
getkirbykirbybefore 3.4.53.4.5Patch availableCNA
—getkirby/panel (Packagist)before 2.5.142.5.14Patch availableGHSA-g3h8-cg9x-47qw
—getkirby/cms (Packagist)3.0.0 to before 3.4.53.4.5Patch availableGHSA-g3h8-cg9x-47qw
  • kirby Vendorgetkirby Affected before 3.4.5 Fixed in 3.4.5 Patch available CNA
  • getkirby/panel (Packagist) Vendor— Affected before 2.5.14 Fixed in 2.5.14 Patch available GHSA-g3h8-cg9x-47qw
  • getkirby/cms (Packagist) Vendor— Affected 3.0.0 to before 3.4.5 Fixed in 3.4.5 Patch available GHSA-g3h8-cg9x-47qw

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*before 3.4.5Vulnerablegetkirby
cpe:2.3:a:getkirby:panel:*:*:*:*:*:*:*:*before 2.5.14Vulnerablegetkirby
  • cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:* Versions before 3.4.5 Vulnerable ·getkirby
  • cpe:2.3:a:getkirby:panel:*:*:*:*:*:*:*:* Versions before 2.5.14 Vulnerable ·getkirby

Remediation

  • Fix · CNA kirby (getkirby) Fixed in 3.4.5
  • Fix · GHSA-g3h8-cg9x-47qw getkirby/panel (Packagist) Fixed in 2.5.14 Advisory →
  • Fix · GHSA-g3h8-cg9x-47qw getkirby/cms (Packagist) Fixed in 3.4.5 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-26255
  2. 2026-10-03 Alias added: GHSA-g3h8-cg9x-47qw

References

Patch 2

Advisory 5

Other 1

  • TI-2024-17440 An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0… CVSS 3.1HIGH 8.8
  • TI-2024-17439 An HTML injection vulnerability exists in the Edit Content Layout module of Kirby CMS… CVSS 3.1HIGH 7.1
  • TI-2026-23396 Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a… CVSS 3.1MEDIUM 6.5
  • TI-2024-17441 A stored cross-site scripting (XSS) vulnerability in the Edit Content Layout module of… CVSS 3.1MEDIUM 6.1
  • TI-2018-10413 An issue was discovered in Kirby 2.5.12. CVSS 3.1MEDIUM 5.4
  • TI-2024-17438 Kirby CMS v4.1.0 was discovered to contain a reflected self-XSS vulnerability via the URL parameter. CVSS 3.1MEDIUM 4.7
See all 40 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences