CVE-2026-29905
published 2026-03-26CVE-2026-29905: Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The…
PriorityP432medium6.5CVSS 3.1
AVNACLPRLUINSUCNINAH
EPSS
0.45%
35.6th percentile
Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.
Affected
2 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| getkirby | cms | >= 0 < 5.2.0-rc.1 | 5.2.0-rc.1 |
| getkirby | kirby | <= 5.1.4 | — |
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Kirby CMS has Persistent DoS via Malformed Image Upload
ghsa·2026-03-27
CVE-2026-29905 [MEDIUM] CWE-20 Kirby CMS has Persistent DoS via Malformed Image Upload
Kirby CMS has Persistent DoS via Malformed Image Upload
## Summary
Kirby CMS through version 5.1.4 allows an authenticated user with Editor permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.
## Details
The vulnerability is caused by improper validation of the return value of PHP's `getimagesize()` function. When a malformed file is uploaded with a valid image extension (e.g., `.jpg`), the function returns `false` instead of an expected array.
The application fails to handle this condition properly and proceeds with image processing, resulting in a fatal `TypeError`. This leads to persistent application crashes when the affected file is accessed.
## Impact
- Persistent Denial of Service (DoS)
- Affected pages return HTTP 500 errors
- Requires manu
OSV
Kirby CMS has Persistent DoS via Malformed Image Upload
osv·2026-03-27
CVE-2026-29905 [MEDIUM] Kirby CMS has Persistent DoS via Malformed Image Upload
Kirby CMS has Persistent DoS via Malformed Image Upload
## Summary
Kirby CMS through version 5.1.4 allows an authenticated user with Editor permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.
## Details
The vulnerability is caused by improper validation of the return value of PHP's `getimagesize()` function. When a malformed file is uploaded with a valid image extension (e.g., `.jpg`), the function returns `false` instead of an expected array.
The application fails to handle this condition properly and proceeds with image processing, resulting in a fatal `TypeError`. This leads to persistent application crashes when the affected file is accessed.
## Impact
- Persistent Denial of Service (DoS)
- Affected pages return HTTP 500 errors
- Requires manu
No detection rules found.
No public exploits indexed.
2026-03-26
Published