CVE-2025-31493
📋 TL;DR
This is a path traversal vulnerability in Kirby CMS that allows attackers to access and execute arbitrary files on the server when dynamic collection names are used. It affects Kirby sites using the collection() helper with user-controlled input. Only sites with fixed collection names are safe.
💻 Affected Systems
- Kirby CMS
📦 What is this software?
Kirby by Getkirby
Kirby by Getkirby
Kirby by Getkirby
⚠️ Risk & Real-World Impact
Worst Case
Complete server compromise including arbitrary code execution, data exfiltration, and lateral movement within the network.
Likely Case
Unauthorized file access leading to sensitive data exposure, configuration file reading, and potential privilege escalation.
If Mitigated
Limited impact with proper input validation and file system permissions restricting PHP process access.
🎯 Exploit Status
Requires knowledge of site structure and file system, but automated fuzzing can identify vulnerable setups.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 3.9.8.3, 3.10.1.2, or 4.7.1 depending on your version
Vendor Advisory: https://github.com/getkirby/kirby/security/advisories/GHSA-x275-h9j4-7p4h
Restart Required: No
Instructions:
1. Identify your Kirby version. 2. Upgrade to the patched version matching your major release: 3.9.x → 3.9.8.3, 3.10.x → 3.10.1.2, 4.x → 4.7.1. 3. Verify the update completed successfully.
🔧 Temporary Workarounds
Disable dynamic collection usage
allReplace all dynamic collection() calls with fixed strings or implement strict input validation
Restrict PHP process permissions
allConfigure web server to run PHP with minimal file system access
🧯 If You Can't Patch
- Audit all collection() calls and ensure no user input reaches the collection name parameter
- Implement web application firewall rules to detect path traversal attempts
🔍 How to Verify
Check if Vulnerable:
Review code for collection() or $kirby->collection() calls using dynamic parameters like user input, request data, or variablesCheck Version:
Check Kirby version in panel or via PHP: echo Kirby::version();Verify Fix Applied:
Check Kirby version is 3.9.8.3, 3.10.1.2, or 4.7.1 or higher📡 Detection & Monitoring
Log Indicators:
- Unusual file access patterns in web server logs
- Failed path traversal attempts
- Access to files outside collections directory
Network Indicators:
- HTTP requests with suspicious path patterns in collection parameters
SIEM Query:
web.url:*collection* AND (web.url:*../* OR web.url:*..\*)