CVE-2020-26255

    Dashboard / Vulnerabilities / CVE-2020-26255

    CVE-2020-26255

    Published: 8 Dec 2020Last Modified: 27 Aug 2026

    Summary:

    Details: Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14 , an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access *cannot* use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend to upgrade your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend to update to Kirby 2.5.14.

    References: https://github.com/getkirby/kirby/releases/tag/3.4.5, https://github.com/getkirby/kirby/security/advisories/GHSA-g3h8-cg9x-47qw, https://packagist.org/packages/getkirby/cms, https://packagist.org/packages/getkirby/panel, https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881, https://github.com/getkirby/kirby/commit/db8f371b13036861c9cc5ba3e85e27f73fce5e09

    Affected packages

    Package

    Name:

    Purl:

    Affected ranges

    Type: GIT

    Events:

    Introduced- 0
    Fixed -efc07a80fd0bfa96c9f142a0a75e26832538ba37

    Affected versions

    2.5.13
    2.5.12
    2.5.11
    2.5.11-RC-1
    2.5.10
    2.5.9
    2.5.9-RC-2
    2.5.9-RC-1
    2.5.8
    2.5.8-RC-1
    2.5.7
    2.5.7-RC-1
    2.5.6
    2.5.6-RC-1
    2.5.5
    2.5.5-RC-1
    2.5.4
    2.5.3
    2.5.2
    2.5.1
    2.5.0

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High
    CVE-2020-26255 | CVE-DB