Kirby CMS versions up to 5.1.4 are affected by a flaw that allows an authenticated user with Editor rights to trigger a persistent Denial of Service by uploading a specially crafted image. The vulnerability occurs because the application does not validate the return value of PHP’s getimagesize() function; when the image is processed for metadata or thumbnail creation, a fatal TypeError is raised, halting the request and potentially bringing the entire site offline.

All installations of Kirby CMS 5.1.4 and earlier run this vulnerability. The issue is fixed in release 5.2.0-rc.1, so any system running that version or later is not susceptible to the weakness described.

The CVSS score of 6.5 indicates a moderate severity, but the EPSS indicates an extremely low exploitation probability (<1%). The vulnerability is not listed in CISA’s KEV catalog. Attack requires an authenticated Editor user with permission to upload images; an attacker with this privilege can repeatedly trigger a crash, leading to prolonged downtime. Because the exploit is limited to internal authenticated users, external attackers cannot directly use it unless they gain account credentials.