CVE-2026-29905

Overview

Field	Value
CVE ID	CVE-2026-29905
Product	Kirby CMS
Affected Versions	≤ 5.1.4
Fixed Version	5.2.0-rc.1
Severity	Medium
CWE	CWE-20 (Improper Input Validation), CWE-252 (Unchecked Return Value)

CVE-2026-29905 is a Persistent Denial of Service (DoS) vulnerability affecting Kirby CMS. The issue allows an authenticated user with Editor privileges to upload a specially crafted malformed image file that causes the application to enter an unrecoverable error state.

The vulnerability exists because the application relies on PHP’s getimagesize() function without properly validating its return value. When processing an invalid image disguised with a legitimate image extension, the function returns false instead of a valid metadata array. Subsequent operations assume successful parsing and trigger a fatal TypeError.

Unlike a temporary application crash, this condition persists across page reloads and administrative sessions until the malicious file is manually removed from the server.

Technical Description

Kirby CMS performs automatic image processing for uploaded media files, including thumbnail generation and metadata extraction.

During this process, the application invokes:

getimagesize($file);

Under normal circumstances, this function returns an array containing image dimensions and metadata. However, if the uploaded file contains invalid image data while retaining a supported extension (such as .jpg or .png), the function returns false.

The application fails to verify this return value before continuing image processing, resulting in an unhandled exception during later operations.

This behavior creates a persistent denial of service condition because every subsequent request attempting to process or display the malformed file reproduces the same fatal error.

Impact

An authenticated user possessing Editor-level permissions can:

1. Upload a malformed image file with a valid extension.
2. Trigger a fatal application error.
3. Cause affected pages to consistently return HTTP 500 responses.
4. Maintain the denial of service state until server-side cleanup is performed.

The vulnerability does not allow arbitrary code execution or privilege escalation, but it significantly impacts application availability and administrative workflow.

Attack Scenario

1. Attacker authenticates with Editor privileges.
2. A malformed file is prepared and renamed with a supported image extension.
3. The file is uploaded through Kirby CMS’s media upload functionality.
4. Kirby attempts to generate image metadata and thumbnails.
5. getimagesize() returns false.
6. The application fails to validate the result and throws a fatal exception.
7. Any page referencing the uploaded resource becomes unavailable until manual intervention.

Root Cause Analysis

The vulnerability originates from insufficient input validation and improper handling of API return values.

The application assumes successful execution of:

$image = getimagesize($file);

without verifying the returned value is valid before accessing its properties.

A proper implementation should validate the result:

$image = getimagesize($file);

if ($image === false) {
    throw new Exception("Invalid image file.");
}

Mitigation

Upgrade to Kirby CMS 5.2.0-rc.1 or any later stable release containing the fix.

Additional defensive measures:

1. Strict server-side file validation before storage.
2. MIME type verification independent of file extension.
3. Rejecting malformed image data before storage.
4. Implementing defensive checks for all image-processing functions.
5. Monitoring upload directories for suspicious or invalid media files.

References

• CVE-2026-29905
• GitHub Security Advisory: GHSA-cw7v-45wm-mcf2
• Kirby CMS 5.2.0-rc.1 Release Notes

---

Researcher: Stalin S (w4nn4d13) — “Curiosity drives research. Responsibility protects everyone.”