Path Traversal Vulnerability in Kirby Content Management System
CVE-2025-30159
What is CVE-2025-30159?
A vulnerability exists in the Kirby content management system, affecting installations that utilize the snippet() helper or $kirby->snippet() method with dynamic snippet naming. This flaw allows malicious actors to bypass path traversal checks, gaining unauthorized access to files on the server. Specifically, if a site employs dynamic snippet names that depend on user input or requests, such as snippet('tags-' . get('tags')), attackers can navigate to files outside the designated snippets root. This vulnerability can compromise the integrity and confidentiality of server resources. The issue has been addressed in updates 3.9.8.3, 3.10.1.2, and 4.7.1, which now includes checks to enforce that snippet paths remain within the specified snippets directory.
Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.
Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.
Affected Version(s)
kirby < 3.9.8.3 < 3.9.8.3
kirby >= 3.10.0, < 3.10.1.2 < 3.10.0, 3.10.1.2
kirby >= 4.0.0, < 4.7.1 < 4.0.0, 4.7.1
References
CVSS V4
Timeline
Vulnerability published
Vulnerability Reserved