GHSA-cw7v-45wm-mcf2

Suggest an improvement
Source
https://github.com/advisories/GHSA-cw7v-45wm-mcf2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-cw7v-45wm-mcf2/GHSA-cw7v-45wm-mcf2.json
JSON Data
https://api.osv.dev/v1/vulns/GHSA-cw7v-45wm-mcf2
Aliases
Withdrawn
2026-04-30T18:33:03Z
Published
2026-03-27T22:21:26Z
Modified
2026-09-10T03:50:38Z
Severity
  • 6.5 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Withdrawn Advisory: Kirby CMS has Persistent DoS via Malformed Image Upload
Details

Duplicate Advisory

This advisory has been withdrawn because it is been determined to not be a vulnerability. This link is maintained to preserve external references.

Original Description

Summary

Kirby CMS through version 5.1.4 allows an authenticated user with Editor permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.

Details

The vulnerability is caused by improper validation of the return value of PHP's getimagesize() function. When a malformed file is uploaded with a valid image extension (e.g., .jpg), the function returns false instead of an expected array.

The application fails to handle this condition properly and proceeds with image processing, resulting in a fatal TypeError. This leads to persistent application crashes when the affected file is accessed.

Impact

  • Persistent Denial of Service (DoS)
  • Affected pages return HTTP 500 errors
  • Requires manual removal of the malformed file to restore functionality
  • Exploitable by authenticated users with Editor permissions

Identifiers

  • CVE-2026-29905

Resources

Database specific 
{
    "cwe_ids": [
        "CWE-20",
        "CWE-252"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2026-03-27T22:21:26Z",
    "nvd_published_at": "2026-03-26T17:16:34Z",
    "severity": "MODERATE"
}
References

Affected packages

Packagist / getkirby/cms

Package

Name
getkirby/cms
Purl
pkg:composer/getkirby/cms

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected
Fixed
5.2.0-rc.1

Affected versions

3.*
3.0.0
3.0.1-rc.1
3.0.1
3.0.2-rc.1
3.0.2
3.0.3-rc.1
3.0.3-rc.2
3.0.3-rc.3
3.0.3
3.1.0-rc.1
3.1.0
3.1.1
3.1.2-rc.1
3.1.2
3.1.3-rc.1
3.1.3
3.1.4-rc.1
3.1.4
3.2.0-rc.1
3.2.0-rc.2
3.2.0-rc.3
3.2.0-rc.4
3.2.0
3.2.1-rc.1
3.2.1
3.2.2
3.2.3-rc.1
3.2.3
3.2.4-rc.1
3.2.4
3.2.5-rc.1
3.2.5-rc.2
3.2.5
3.3.0-rc.1
3.3.0-rc.2
3.3.0-rc.3
3.3.0-rc.4
3.3.0-rc.5
3.3.0
3.3.1-rc.1
3.3.1
3.3.2-rc.1
3.3.2
3.3.3-rc.1
3.3.3
3.3.4-rc.1
3.3.4
3.3.5-rc.1
3.3.5
3.3.6
3.4.0-rc.1
3.4.0-rc.2
3.4.0-rc.3
3.4.0
3.4.1-rc.1
3.4.1
3.4.2
3.4.3-rc.1
3.4.3
3.4.4-rc.1
3.4.4
3.4.5
3.5.0-rc.1
3.5.0-rc.2
3.5.0-rc.3
3.5.0-rc.4
3.5.0-rc.5
3.5.0-rc.6
3.5.0-rc.7
3.5.0
3.5.1-rc.1
3.5.1
3.5.2-rc.1
3.5.2
3.5.3
3.5.3.1
3.5.4
3.5.5-rc.1
3.5.5
3.5.6-rc.1
3.5.6
3.5.7-rc.1
3.5.7
3.5.7.1
3.5.8
3.5.8.1
3.5.8.2
3.5.8.3
3.5.8.4
3.6.0-alpha.1
3.6.0-alpha.2
3.6.0-alpha.3
3.6.0-alpha.4
3.6.0-beta.1
3.6.0-beta.2
3.6.0-beta.3
3.6.0-rc.1
3.6.0-rc.2
3.6.0-rc.3
3.6.0-rc.4
3.6.0-rc.5
3.6.0
3.6.1
3.6.1.1
3.6.2-rc.1
3.6.2-rc.2
3.6.2-rc.3
3.6.2
3.6.3-rc.1
3.6.3-rc.2
3.6.3
3.6.3.1
3.6.4-rc.1
3.6.4
3.6.5-rc.1
3.6.5
3.6.6-rc.1
3.6.6
3.6.6.1
3.6.6.2
3.6.6.3
3.6.6.4
3.6.6.5
3.6.6.6
3.7.0-rc.1
3.7.0-rc.2
3.7.0-rc.3
3.7.0
3.7.0.1
3.7.0.2
3.7.1-rc.1
3.7.1
3.7.2-rc.1
3.7.2
3.7.2.1
3.7.3-rc.1
3.7.3
3.7.4-rc.1
3.7.4
3.7.5
3.7.5.1
3.7.5.2
3.7.5.3
3.7.5.4
3.7.5.5
3.8.0-rc.1
3.8.0-rc.2
3.8.0-rc.3
3.8.0
3.8.1-rc.1
3.8.1
3.8.1.1
3.8.2-rc.1
3.8.2
3.8.3-rc.1
3.8.3-rc.2
3.8.3
3.8.4
3.8.4.1
3.8.4.2
3.8.4.3
3.8.4.4
3.9.0-rc.1
3.9.0-rc.2
3.9.0
3.9.1-rc.1
3.9.1
3.9.2-rc.1
3.9.2
3.9.3-rc.1
3.9.3
3.9.4-rc.1
3.9.4
3.9.5-rc.1
3.9.5
3.9.6-rc.1
3.9.6
3.9.6.1
3.9.7-rc.1
3.9.7
3.9.8-rc.1
3.9.8
3.9.8.1
3.9.8.2
3.9.8.3
3.10.0
3.10.0.1
3.10.1
3.10.1.1
3.10.1.2
4.*
4.0.0-alpha.1
4.0.0-alpha.2
4.0.0-alpha.3
4.0.0-alpha.4
4.0.0-alpha.5
4.0.0-alpha.6
4.0.0-alpha.7
4.0.0-beta.1
4.0.0-beta.2
4.0.0-beta.3
4.0.0-rc.1
4.0.0-rc.2
4.0.0-rc.3
4.0.0-rc.4
4.0.0
4.0.1
4.0.2
4.0.3
4.1.0-rc.1
4.1.0-rc.2
4.1.0-rc.3
4.1.0
4.1.1
4.1.2
4.2.0-rc.1
4.2.0
4.3.0-rc.1
4.3.0
4.3.1
4.4.0-rc.1
4.4.0
4.4.1
4.5.0-rc.1
4.5.0
4.6.0-rc.1
4.6.0
4.6.1
4.7.0-rc.1
4.7.0
4.7.1
4.7.2
4.8.0-rc.1
4.8.0
4.9.0
4.9.1
4.9.2
4.9.3
4.9.4
4.9.5
5.*
5.0.0-alpha.1
5.0.0-alpha.2
5.0.0-alpha.3
5.0.0-alpha.4
5.0.0-beta.1
5.0.0-beta.2
5.0.0-beta.3
5.0.0-beta.4
5.0.0-beta.5
5.0.0-beta.6
5.0.0-rc.1
5.0.0-rc.2
5.0.0-rc.3
5.0.0-rc.4
5.0.0-rc.5
5.0.0-rc.6
5.0.0
5.0.1
5.0.2
5.0.3
5.0.4
5.1.0-rc.1
5.1.0
5.1.1
5.1.2
5.1.3
5.1.4

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/03/GHSA-cw7v-45wm-mcf2/GHSA-cw7v-45wm-mcf2.json"