An unauthenticated path traversal vulnerability in Kirby CMS allows remote attackers to perform unauthorized file operations, posing a significant risk to data confidentiality and system integrity.

This is a path traversal vulnerability (CWE-22) located in the media handler (src/Cms/Media.php) and file versioning (src/Filesystem/Asset.php) components. By supplying encoded slash characters or directory traversal sequences, an unauthenticated remote attacker can bypass intended directory restrictions to access arbitrary files or trigger unauthorized file deletions.

Successful exploitation allows an attacker to confirm the existence of sensitive files and potentially delete critical system job files, leading to unauthorized information disclosure and denial of service. With a CVSS score of 8.2, this vulnerability is considered high severity, as it requires no authentication and can be triggered remotely by an attacker to compromise the integrity and availability of the content management system.

Immediate Action: Update Kirby to version 4.9.5 or 5.5.2 immediately to incorporate the necessary path validation fixes.

Proactive Monitoring: Review web server access logs for requests containing encoded characters like %2f or directory traversal sequences such as ../ directed toward media or asset endpoints.

Compensating Controls: Implement a Web Application Firewall (WAF) rule to block incoming requests that contain directory traversal patterns or suspicious encoded slashes in URLs associated with media and asset processing.

Public Exploit Available: Unknown.

Given the high CVSS score and the potential for both information disclosure and service disruption, administrators should prioritize applying the security updates to version 4.9.5 or 5.5.2. Testing the update in a staging environment is recommended, but the urgency of this fix warrants an expedited deployment schedule to secure the application against potential exploitation.