Kirby vulnerable to unrestricted file upload of user avatar images

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

4.6 · CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:L/I:L/A:N

EPSS

• CVE-2024-26483: 0.97% estimated exploitation activity in the next 30 days; percentile 61.76 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

TL;DR This vulnerability affects all Kirby sites that might have potential attackers in the group of authenticated Panel users. The attack requires user interaction by another user or visitor and cannot be automated. ---- Introduction Unrestricted upload of files with a dangerous type is a type of vulnerability that allows to circumvent expectations and protections in the server setup or backend code. Uploaded files are not checked for their compliance with the intended purpose of the upload target, which can introduce secondary attack vectors. While the vulnerability described here does not allow critical attacks like remote code execution (RCE), it can still be abused to upload unexpected file types that could for example make it possible to perform cross-site scripting (XSS) attacks. Impact Users with Panel access can upload a user avatar in their own account view. This avatar is intended to be an image, however the file type or file extension was not validated on the backend.…

Published by the source

26 Feb 2024, 16:22 UTC

Last modified by the source

15 Mar 2026, 05:09 UTC

Source last checked

26 Oct 2026, 14:38 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-xrvh-rvc4-5m43

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2024-26483

Advisory: Kirby vulnerable to unrestricted file upload of user avatar images
IDs: CVE-2024-26483, GHSA-xrvh-rvc4-5m43
Record: https://patchnext.com/advisories/cve-2024-26483 (revision 1, source checked 26 Oct 2026, 14:38 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: Medium (CVSS 4.6)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: getkirby/cms 4.1.1, 3.10.0.1, 3.9.8.1, 3.8.4.3, 3.7.5.4, 3.6.6.5. A vendor fix does not mean a deployment is fixed.

## Affected components
- Packagist getkirby/cms: affected <= 3.6.6.4; >= 3.7.0, <= 3.7.5.3; >= 3.8.0, <= 3.8.4.2; >= 3.9.0, <= 3.9.8; >= 3.10.0, <= 3.10.0; >= 4.0.0, <= 4.1.0; fixed in 3.6.6.5, 3.9.8.1, 3.10.0.1, 4.1.1, 3.7.5.4, 3.8.4.3

## Suggested inspection (read-only)
- Packagist getkirby/cms: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on getkirby/cms.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-xrvh-rvc4-5m43 (GitHub-reviewed advisory GHSA-xrvh-rvc4-5m43 lists affected ranges: Packagist getkirby/cms >=0 =3.7.0 =3.8.0 =3.9.0 =3.10.0 =4.0.0 <=4.1.0)

Commands are suggestions: review each one before running it.