Kirby’s REST API allows an authenticated user with the "access.panel" permission but lacking file creation or replacement rights to upload incomplete file chunks without performing the necessary authorization check before persisting them. The COS holds temporary files in the site’s cache directory and leaves them unused for 24 hours, consuming attacker‑controlled storage. Repeating the abuse can deplete disk space, prevent other users from uploading files, or disrupt site logic that relies on file storage, although the final checks prevent files from being placed in the primary content or account directories. This flaw is a missing authorization check for a sensitive resource (CWE‑862).

The vulnerability exists in Kirby versions 5.0.0 through 5.5.2 inclusive. All instances of the GetKirby:Kirby CMS running these versions are affected. The fix was released in Kirby 5.5.2 and later.

The CVSS score of 7.1 indicates high impact and a moderate to high probability of exploitation with an authenticated attacker. The EPSS score is not available, so the current exploitation probability cannot be quantified. The vulnerability is not listed in the CISA KEV catalog. An attacker needs an account with "access.panel" permission, which is a realistic scenario on multi‑user sites, and can reach the API endpoint via standard HTTP requests. Exploitation results in storage exhaustion and potential denial of service but does not grant arbitrary code execution or unauthorized file access to core directories.