Packagist/getkirby/panel CVE-2020-26255: medium 6.8, EPSS 1.49%

Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5

Action: Upgrade getkirby/panel to 2.5.14 or later.

composer require getkirby/panel:2.5.14

Affected

Fixed versions

Sources

• osv: GHSA-g3h8-cg9x-47qw
• https://github.com/getkirby/kirby/security/advisories/GHSA-g3h8-cg9x-47qw
• https://nvd.nist.gov/vuln/detail/CVE-2020-26255
• https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881
• https://github.com/getkirby/kirby/commit/db8f371b13036861c9cc5ba3e85e27f73fce5e09
• https://github.com/getkirby/kirby
• https://github.com/getkirby/kirby/releases/tag/3.4.5
• https://packagist.org/packages/getkirby/cms
• https://packagist.org/packages/getkirby/panel

CVE-2020-26255 · published 2020-12-08T14:42:08Z · modified 2026-09-10T03:48:59.944013053Z · JSON