highCVE-2026-71415Aug 31, 2026

CVE-2026-71415: Kirby CMS Unauthenticated Chunked Upload Storage Exhaustion

Pranav Khune
Penetration Testing Team Lead, SecureLayer7

A low-privilege Kirby CMS user with panel access but no file upload permissions could repeatedly send partial chunked upload requests to fill the server's temporary upload directory, potentially…

Packagegetkirby/cms
Ecosystemcomposer
Affected>= 5.0.0, < 5.5.2
Fixed in5.5.2
CVE-2026-71415: Kirby CMS Unauthenticated Chunked Upload Storage Exhaustion

The problem

Kirby's REST API supports chunked file uploads that store partial data in site/cache/.uploads until the final chunk arrives. In versions 5.0.0 through 5.5.1, the chunk handler (Kirby\Api\Upload::processChunk()) wrote chunk data to disk before the authorization preflight in Kirby\Api\Upload::process() had a chance to run.

Any authenticated user with the access.panel permission, even one explicitly denied files.create, files.replace, and users.update, could abuse this. By sending only the first chunk and never completing the upload, an attacker caused Kirby to retain temp files for 24 hours per request.

Repeating this loop consumed disk space and could prevent other users or site logic from writing files.

Proof of concept

A working proof-of-concept for CVE-2026-71415 in getkirby/cms, with the exact payload below.

http
POST /api/pages/notes+a-page/files HTTP/1.1
Host: target.example.com
Authorization: Bearer <low-priv-session-token>
Content-Type: application/octet-stream
Upload-Length: 104857600
Upload-Offset: 0
Content-Length: 5242880

<5 MB of arbitrary binary data — never send the final chunk>

The root cause is CWE-862 (Missing Authorization). Before the patch, Upload::process() called processChunk() first, which immediately persisted the incoming bytes to site/cache/.uploads, and only checked upload permissions when the *final* chunk arrived.

An attacker could set a large Upload-Length header and submit an initial chunk repeatedly, forcing Kirby to accumulate partial temp files each valid for 24 hours before automatic cleanup. The files never reached content/ or site/accounts/ because final-step permission checks were intact, but the disk exhaustion was real.

The patch (commit 37e206f) adds a permission preflight inside Upload::process() that runs before processChunk() is ever called, aborting the request immediately if the user lacks the relevant upload permission.

The fix

Update to Kirby 5.5.2 or later. If an immediate upgrade is not possible, remove REST API access (access.panel: false) for any role that should not upload files as a temporary mitigation.

Reported by alcls01111.

References: [1][2][3][4][5][6]

Related research