CVE-2020-26255: 
PHP vulnerability analysis and mitigation

Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14, contained a critical vulnerability (CVE-2020-26255) that allowed authenticated users with Panel access to upload and execute PHP .phar files on the server. The vulnerability was discovered and reported by security researcher Thore Imhof of Accenture in December 2020 (GitHub Security).

The vulnerability is classified as CWE-434 (Unrestricted Upload of File with Dangerous Type) and received a CVSS v3.1 score of 10.0 (Critical). The issue stems from insufficient file upload validation that allowed .phar files to be uploaded and executed on the server. While the system had restrictions for PHP files, it did not properly block PHAR archives, which could be used to execute arbitrary PHP code (GitHub Advisory).

The vulnerability could allow authenticated users with Panel access to gain unauthorized server access and execute arbitrary code. This was particularly critical in environments where potential attackers might have legitimate access to the Kirby Panel. However, it's important to note that visitors without Panel access could not exploit this vulnerability (Kirby Release).

The vulnerability required an authenticated user with Panel access to exploit. The attack could be performed by uploading a specially crafted PHAR file through the Panel interface. The attacker would need low privileges and no special user interaction was required beyond the file upload (GitHub Security).

The vulnerability was patched in Kirby 2.5.14 and Kirby 3.4.5. Users were strongly advised to upgrade to these versions or later to fix the vulnerability. For Kirby 2 users, which reached end-of-life on December 31, 2020, it was recommended to upgrade to Kirby 3. If upgrading was not immediately possible, users were advised to at least update to Kirby 2.5.14 (GitHub Security).