https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 09:39:18 +0000 https://cve.radiocsirt.org/vuln/euvd-2026-277649 EUVD-2026-277649 https://cve.radiocsirt.org/vuln/euvd-2026-277649 https://cve.radiocsirt.org/vuln/fkie_cve-2026-29905 <p>Kirby CMS through 5.1.4 allows an authenticated user with &#39;Editor&#39; permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.</p> <p>Kirby CMS through 5.1.4 allows an authenticated user with &#39;Editor&#39; permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-29905 https://cve.radiocsirt.org/vuln/ghsa-cw7v-45wm-mcf2 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### Duplicate Advisory This advisory has been withdrawn because it is been determined to not be a vulnerability. This link is maintained to preserve external references.</p> <p>### Original Description</p> <p>## Summary</p> <p>Kirby CMS through version 5.1.4 allows an authenticated user with Editor permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.</p> <p>## Details</p> <p>The vulnerability is caused by improper validation of the return value of PHP&#39;s `getimagesize()` function. When a malformed file is uploaded with a valid image extension (e.g., `.jpg`), the function returns `false` instead of an expected array.</p> <p>The application fails to handle this condition properly and proceeds with image processing, resulting in a fatal `TypeError`. This leads to persistent application crashes when the affected file is accessed.</p> <p>## Impact</p> <p>- Persistent Denial of Service (DoS) - Affected pages return HTTP 500 errors - Requires manual removal of the malformed file to restore functionality - Exploitable by authenticated users with Editor permissions</p> <p>## Identifiers - CVE-2026-29905</p> <p>## Resources</p> <p>- https://github.com/github/advisory-database/pull/7503 - https://github.com/Stalin-143/CVE-2026-29905 - https://github.com/getkirby/kirby/releases/tag/5.2.0-rc.1 - https://www.cve.org/CVERecord?id=CVE-2026-29905</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> Packagist: getkirby/cms</p> <p>### Duplicate Advisory This advisory has been withdrawn because it is been determined to not be a vulnerability. This link is maintained to preserve external references.</p> <p>### Original Description</p> <p>## Summary</p> <p>Kirby CMS through version 5.1.4 allows an authenticated user with Editor permissions to cause a persistent Denial of Service (DoS) via a malformed image upload.</p> <p>## Details</p> <p>The vulnerability is caused by improper validation of the return value of PHP&#39;s `getimagesize()` function. When a malformed file is uploaded with a valid image extension (e.g., `.jpg`), the function returns `false` instead of an expected array.</p> <p>The application fails to handle this condition properly and proceeds with image processing, resulting in a fatal `TypeError`. This leads to persistent application crashes when the affected file is accessed.</p> <p>## Impact</p> <p>- Persistent Denial of Service (DoS) - Affected pages return HTTP 500 errors - Requires manual removal of the malformed file to restore functionality - Exploitable by authenticated users with Editor permissions</p> <p>## Identifiers - CVE-2026-29905</p> <p>## Resources</p> <p>- https://github.com/github/advisory-database/pull/7503 - https://github.com/Stalin-143/CVE-2026-29905 - https://github.com/getkirby/kirby/releases/tag/5.2.0-rc.1 - https://www.cve.org/CVERecord?id=CVE-2026-29905</p> https://cve.radiocsirt.org/vuln/ghsa-cw7v-45wm-mcf2