An attacker can exploit a path‑traversal flaw in Kirby’s media handling component (Cms/Media.php) to craft a filename containing encoded slashes that bypass directory validation. This flaw allows the thumb() method to access any file outside the intended media directory, leading to potential Remote File Read and, in some circumstances, deletion of a related job file. The vulnerability is effective when served by nginx, PHP’s built‑in server, or Apache with AllowEncodedSlashes enabled, and can also affect the Asset.php file path resolution.

Vulnerable releases are all Kirby versions before 4.9.5 on the 4.x branch and before 5.5.2 on the 5.x branch. The affected vendor is getkirby:kirby. Users of these releases must apply the patch included in releases 4.9.5 and 5.5.2 or later.

The vulnerability carries a CVSS score of 8.2, classifying it as High severity. No EPSS score is published, so the baseline probability of exploitation is unclear, but the CVE is not listed in CISA’s KEV database. Because the flaw can be triggered purely via HTTP requests without authentication, the attack vector is remote and can disclose arbitrary files on the host. An attacker could use the flaw to read sensitive configuration or code files, or to delete a job file, thereby impacting confidentiality, integrity, and availability of the affected site.