Medium · published May 13, 2025
⚠️ A sneaky missing path traversal check is lurking in Kirby! If you're using dynamic collection names, you might be at risk of unexpected file access! 🔍 Think of this like a pizza delivery service that mistakenly allows customers to access the entire kitchen instead of just the menu items. If someone knows the right prompts, they could order up all sorts of confidential recipes lurking behind the scenes! In a vulnerable setup, an attacker could gain access to any file the PHP process can read, potentially executing dangerous code. This means your server's confidentiality and integrity are at stake; they could even delete or modify vital components, which could be absolutely devastating for your site!
Think of this like a pizza delivery service that mistakenly allows customers to access the entire kitchen instead of just the menu items. If someone knows the right prompts, they could order up all sorts of confidential recipes lurking behind the scenes! This vulnerability arises from the use of dynamic collection names in the `collection()` helper or `$kirby->collection()` method, allowing attackers to navigate beyond the intended directory due to the lack of a robust path traversal check.
In a vulnerable setup, an attacker could gain access to any file the PHP process can read, potentially executing dangerous code. This means your server's confidentiality and integrity are at stake; they could even delete or modify vital components, which could be absolutely devastating for your site! To secure your site, immediately update to Kirby versions 3.9.8.3, 3.10.1.2, or 4.7.1. Additionally, avoid using dynamic collection names that rely on user input until you've thoroughly reviewed your site code for vulnerabilities. Regular audits of your setup will help maintain security! You've got this! By following these steps, you’ll fortify your Kirby site in no time! 🛡️