CVE-2026-29905

6.5 mediumEPSS 0.5%

Medium (6.5) in getkirby kirby. EPSS 0.5% chance of exploitation in the next 30 days.

Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.

Severity

CVSS 3.1

6.5 medium

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

EPSS: 0.5% chance of exploitation in the next 30 days; higher than 40% of CVEs (scores of 2026-10-31)
CWEs: CWE-20, CWE-252
Published: 2026-03-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

getkirby:kirby

References

https://drive.google.com/file/d/1MwvvSYIwnC8kOIzjycGMQZw4d2K2ef8h/view?usp=sharing
https://github.com/Stalin-143/CVE-2026-29905
https://github.com/getkirby/kirby/releases/tag/5.2.0-rc.1

Check your stack JSON