CVE-2020-26255 : What You Need to Know

Kirby is a CMS. In Kirby CMS (getkirby/cms) before version 3.4.5, and Kirby Panel before version 2.5.14, an editor with full access to the Kirby Panel can upload a PHP .phar file and execute it on the server. This vulnerability is critical if you might have potential attackers in your group of authenticated Panel users, as they can gain access to the server with such a Phar file. Visitors without Panel access cannot use this attack vector. The problem has been patched in Kirby 2.5.14 and Kirby 3.4.5. Please update to one of these or a later version to fix the vulnerability. Note: Kirby 2 reaches end of life on December 31, 2020. We therefore recommend upgrading your Kirby 2 sites to Kirby 3. If you cannot upgrade, we still recommend updating to Kirby 2.5.14.

Understanding CVE-2020-26255

This section provides insights into the impact and technical details of the CVE.

What is CVE-2020-26255?

CVE-2020-26255 is a vulnerability in Kirby CMS and Kirby Panel that allows an editor with full access to upload a PHP .phar file and execute it on the server, potentially leading to unauthorized access.

The Impact of CVE-2020-26255

The vulnerability has the following impact:

CVSS Base Score: 6.8 (Medium)
Attack Vector: Network
Integrity Impact: High
Privileges Required: High
Scope: Changed

Technical Details of CVE-2020-26255

This section covers the technical aspects of the vulnerability.

Vulnerability Description

The vulnerability allows an attacker to upload and execute PHP .phar files in Kirby CMS and Kirby Panel versions prior to 3.4.5 and 2.5.14, respectively.

Affected Systems and Versions

Affected Product: Kirby
Vendor: getkirby
Vulnerable Versions:
Kirby CMS < 3.4.5
Kirby Panel < 2.5.14

Exploitation Mechanism

The vulnerability can be exploited by an authenticated editor with full access to the Kirby Panel uploading a malicious PHP .phar file to execute it on the server.

Mitigation and Prevention

Protect your systems from CVE-2020-26255 with the following steps:

Immediate Steps to Take

Update Kirby CMS to version 3.4.5 or later
Update Kirby Panel to version 2.5.14 or later

Long-Term Security Practices

Regularly review and update access privileges
Educate users on safe file upload practices

Patching and Updates

Apply patches provided by Kirby to address the vulnerability