{"description":"Trending threats, MITRE ATT\u0026CK coverage, and detection metadata. Fed continuously.","favicon":"https://feed.craftedsignal.io/favicon-32x32.png","feed_url":"https://feed.craftedsignal.io/cpes/cpe2.3akirbycms/feed.json","home_page_url":"https://feed.craftedsignal.io/","icon":"https://feed.craftedsignal.io/apple-touch-icon.png","items":[{"_cs_actors":[],"_cs_cpes":["cpe:2.3:a:kirby:cms:*:*:*:*:*:*:*:*"],"_cs_cves":[{"id":"CVE-2026-71415"}],"_cs_exploited":true,"_cs_has_poc":false,"_cs_poc_references":[],"_cs_products":["Kirby CMS (\u003e= 5.0.0, \u003c 5.5.2)","Kirby CMS (\u003c 4.9.5, 5.0.0-5.5.1)"],"_cs_severities":["high"],"_cs_tags":["web-application","denial-of-service","api-security","web-application-vulnerability","path-traversal","cms"],"_cs_type":"threat","_cs_vendors":["Kirby"],"content_html":"\u003cp\u003eKirby CMS versions 5.0.0 through 5.5.1 are vulnerable to a missing authorization flaw (CVE-2026-71415) within the REST API chunked file upload handler. An authenticated user, even one explicitly denied 'files.create', 'files.replace', or 'user/users.update' permissions, can initiate a chunked upload process. The application fails to validate these permissions before writing incoming file chunks to a temporary directory on the server.\u003c/p\u003e\n\u003cp\u003eThis flaw allows an attacker to repeatedly upload large files in chunks without ever completing the final assembly. Because the application retains these incomplete files in the temporary directory for 24 hours, an attacker can intentionally saturate available disk space. This activity causes a denial-of-service condition, preventing legitimate users from performing authorized file uploads or potentially disrupting other site functions that rely on server storage availability.\u003c/p\u003e\n\u003ch2 id=\"impact\"\u003eImpact\u003c/h2\u003e\n\u003cp\u003eThe vulnerability allows authenticated attackers to perform a resource exhaustion attack against server storage. Success results in potential service interruption for legitimate file operations. While the exploit does not bypass final permission checks for data moved to the 'content' or 'site/accounts' directories, the ability to consume disk space at will represents a high-severity availability risk for impacted sites.\u003c/p\u003e\n\u003ch2 id=\"recommendation\"\u003eRecommendation\u003c/h2\u003e\n\u003cp\u003ePrioritized actions for administrators:\u003c/p\u003e\n\u003cul\u003e\n\u003cli\u003ePatch Kirby CMS immediately by upgrading to version 5.5.2 or later to include the mandatory preflight permission checks.\u003c/li\u003e\n\u003cli\u003eMonitor web server logs for high volumes of POST requests to REST API upload routes originating from accounts identified as having restricted file upload permissions.\u003c/li\u003e\n\u003cli\u003eReview disk usage monitoring metrics to identify spikes in temporary file storage that may indicate active exploitation attempts.\u003c/li\u003e\n\u003c/ul\u003e\n","date_modified":"2026-08-31T23:58:31Z","date_published":"2026-08-31T23:58:20Z","id":"https://feed.craftedsignal.io/briefs/2026-08-kirby-unauth-chunk-upload/","summary":"Authenticated users without file upload permissions can exploit a missing authorization check in Kirby CMS to exhaust server storage via incomplete chunked file uploads, leading to denial-of-service.","title":"Missing Authorization in Kirby CMS REST API Chunked Upload Handler","url":"https://feed.craftedsignal.io/briefs/2026-08-kirby-unauth-chunk-upload/"}],"language":"en","title":"CraftedSignal Threat Feed - Cpe:2.3:a:kirby:cms:*:*:*:*:*:*:*:*","version":"https://jsonfeed.org/version/1.1"}