CVE-2025-30207: 
PHP vulnerability analysis and mitigation

Kirby, an open-source content management system, disclosed a path traversal vulnerability (CVE-2025-30207) affecting versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1. The vulnerability specifically impacts Kirby setups using PHP's built-in server, which is commonly used during local development. Sites using other server software like Apache, nginx, or Caddy are not affected (GitHub Advisory).

The vulnerability stems from a missing path traversal check in the router.php file provided for PHP's built-in web server. The vulnerable implementation delegated all existing files to PHP, including files outside of the document root. By using special elements such as '..' and '/' separators, attackers could navigate to files on the server that were accessible to the PHP process, including those outside of the Kirby installation. The vulnerability has been assigned a CVSS v4.0 score of 2.3 (Low) with the vector string CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N (NVD).

When exploited, the vulnerability allows attackers to determine whether requested files exist on the system through different server responses. However, the impact is limited as Kirby's router only delegates requests to PHP without loading or executing them, and PHP treats requests to files outside the document root as invalid. Therefore, while file existence could be detected, the actual contents of the files were not exposed (GitHub Advisory).

The issue has been patched in Kirby versions 3.9.8.3, 3.10.1.2, and 4.7.1. The fix includes an updated router that checks if existing static files are within the document root. After the patch, requests to files outside the document root are treated as page requests of the error page and will no longer allow determination of file existence. Users are recommended to upgrade to one of these patched versions (GitHub Release).

The vulnerability was responsibly disclosed by security researchers Bruno Meilick and Tobias Möritz, who brought this type of attack vector to the attention of the Kirby maintainers (GitHub Release).