Kirby CMS contains a path traversal flaw in its media thumbnail generator. The flaw is caused by incomplete containment checks that compare the real path of a requested file to the site root. The checks allow a sibling directory whose path contains the root string but does not end with a directory separator to be treated as inside the site. By sending a crafted thumbnail request to Kirby\Cms\Media::thumb() with a path that points to such a sibling directory, an attacker can cause Kirby to resolve a file located outside the site root and return it to the client. The flaw also deletes the thumbnail job file during processing, which can remove staging or backup job files. This enables unauthorized read and deletion of files that belong to other sites or internal staging areas.

Any getkirby:kirby installation running a version earlier than 4.9.5 on the legacy line or earlier than 5.5.2 on the current line is affected. The vulnerability applies regardless of hosting environment because the weakness is in the core media handling code.

The CVSS score of 6.9 labels the vulnerability as moderate and the EPSS score is unavailable. The attack vector requires only a crafted HTTP request to the thumbnail endpoint and does not need additional credentials. No public exploit or proof‑of‑concept code is known and the vulnerability is not listed in the CISA KEV catalog, but the ease of triggering it over the web makes it a realistic threat for any exposed Kirby installation.