Missing Authorization in Kirby CMS REST API Chunked Upload Handler

Kirby CMS versions 5.0.0 through 5.5.1 are vulnerable to a missing authorization flaw (CVE-2026-71415) within the REST API chunked file upload handler. An authenticated user, even one explicitly denied 'files.create', 'files.replace', or 'user/users.update' permissions, can initiate a chunked upload process. The application fails to validate these permissions before writing incoming file chunks to a temporary directory on the server.

This flaw allows an attacker to repeatedly upload large files in chunks without ever completing the final assembly. Because the application retains these incomplete files in the temporary directory for 24 hours, an attacker can intentionally saturate available disk space. This activity causes a denial-of-service condition, preventing legitimate users from performing authorized file uploads or potentially disrupting other site functions that rely on server storage availability.

Impact

The vulnerability allows authenticated attackers to perform a resource exhaustion attack against server storage. Success results in potential service interruption for legitimate file operations. While the exploit does not bypass final permission checks for data moved to the 'content' or 'site/accounts' directories, the ability to consume disk space at will represents a high-severity availability risk for impacted sites.

Recommendation

Prioritized actions for administrators:

• Patch Kirby CMS immediately by upgrading to version 5.5.2 or later to include the mandatory preflight permission checks.
• Monitor web server logs for high volumes of POST requests to REST API upload routes originating from accounts identified as having restricted file upload permissions.
• Review disk usage monitoring metrics to identify spikes in temporary file storage that may indicate active exploitation attempts.