Vulnerability DatabaseCVE-2025-31493

CVE-2025-31493:
PHP vulnerability analysis and mitigation

Overview

Kirby, an open-source content management system, disclosed a path traversal vulnerability (CVE-2025-31493) affecting versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1. The vulnerability affects all Kirby sites that use the collection() helper or $kirby->collection() method with a dynamic collection name. Sites that only use fixed calls to these methods with simple string parameters are not affected. The vulnerability was discovered and disclosed on May 13, 2025 (GitHub Advisory).

Technical details

The vulnerability stems from a missing path traversal check in the collection() helper and $kirby->collection() method. When processing dynamic collection names, the system failed to properly validate path elements, allowing attackers to use special sequences like '../' to navigate outside the configured collections root. The vulnerability has been assigned a CVSS v4.0 base score of 6.3 (Medium) with the vector string CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:L/VA:N/SC:L/SI:L/SA:N (GitHub Advisory).

Impact

The vulnerability allows attackers to navigate and access all files on the server that are accessible to the PHP process, including files outside of the collections root or the Kirby installation. When exploited, attackers can execute PHP code within accessed files, potentially mapping the server's file system, accessing sensitive configuration files containing security tokens, and causing unintended execution of PHP scripts. The attack requires an initial vector in the site code through dynamic collection names, such as collection('tags-' . get('tags')) (GitHub Advisory).

Mitigation and workarounds

The vulnerability has been patched in Kirby versions 3.9.8.3, 3.10.1.2, and 4.7.1. The fix implements a check for collection paths to ensure they remain contained within the configured collections root. Any collection paths that point outside of the collections root will not be loaded. Users are advised to update to one of these patched versions or later releases (GitHub Release).

Community reactions

The security community acknowledged the responsible disclosure by Bruno Meilick (@bnomei) and Tobias Möritz (@tobimori), who brought this attack vector to the attention of the Kirby team (GitHub Release).