| Package | Affected versions | Patched versions |
|---|---|---|
| getkirby/cms | < 5.2.0-rc.1 | 5.2.0-rc.1 |
| kirby | ≤ 5.1.4 |
This advisory has been withdrawn because it is been determined to not be a vulnerability. This link is maintained to preserve external references.
Kirby CMS through version 5.1.4 allows an authenticated user with Editor permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.
The vulnerability is caused by improper validation of the return value of PHP's getimagesize() function. When a malformed file is uploaded with a valid image extension (e.g., .jpg), the function returns false instead of an expected array.
The application fails to handle this condition properly and proceeds with image processing, resulting in a fatal TypeError. This leads to persistent application crashes when the affected file is accessed.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free