CVE-2025-30159
📋 TL;DR
This is a path traversal vulnerability in Kirby CMS that allows attackers to read and execute arbitrary files on the server when dynamic snippet names are used. It affects Kirby sites using the snippet() helper with user-controlled input. Only sites with fixed snippet names are safe.
💻 Affected Systems
- Kirby CMS
📦 What is this software?
Kirby by Getkirby
Kirby by Getkirby
Kirby by Getkirby
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise including remote code execution, data exfiltration, and system takeover
Likely Case
Sensitive file disclosure (config files, credentials, source code) leading to further exploitation
If Mitigated
Limited impact with proper input validation and file system permissions
🎯 Exploit Status
Requires knowledge of site structure but can be discovered through fuzzing
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.8.3, 3.10.1.2, or 4.7.1 depending on your version
Vendor Advisory: https://github.com/getkirby/kirby/security/advisories/GHSA-fw82-87p8-v6hp
Restart Required: No
Instructions:
1. Identify your Kirby version. 2. Upgrade to 3.9.8.3 if on 3.9.x, 3.10.1.2 if on 3.10.x, or 4.7.1 if on 4.x. 3. Test functionality after upgrade.
🔧 Temporary Workarounds
Disable dynamic snippet calls
allReplace all dynamic snippet() calls with fixed string values
Input validation wrapper
allCreate a wrapper function that validates snippet names before passing to snippet()
🧯 If You Can't Patch
- Review all snippet() calls and ensure no user input reaches the function
- Implement strict file system permissions to limit PHP process access
🔍 How to Verify
Check if Vulnerable:
Check if your Kirby version is below 3.9.8.3, 3.10.1.2, or 4.7.1 and search codebase for dynamic snippet() callsCheck Version:
Check Kirby version in composer.json or via phpinfo()Verify Fix Applied:
Verify version is 3.9.8.3+, 3.10.1.2+, or 4.7.1+ and test snippet functionality📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in PHP logs
- Multiple failed snippet load attempts with path traversal patterns
Network Indicators:
- HTTP requests with suspicious snippet parameters containing ../ patterns
SIEM Query:
web_access_logs WHERE uri CONTAINS 'snippet' AND (uri CONTAINS '../' OR uri CONTAINS '..\\')