Packagist/getkirby/cms CVE-2020-26255: medium 6.8, EPSS 1.49%

Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5

Action: Upgrade getkirby/cms to 3.4.5 or later.

composer require getkirby/cms:3.4.5

Affected

Fixed versions

Sources

• osv: GHSA-g3h8-cg9x-47qw#Packagist/getkirby/cms
• https://github.com/getkirby/kirby/security/advisories/GHSA-g3h8-cg9x-47qw
• https://nvd.nist.gov/vuln/detail/CVE-2020-26255
• https://github.com/getkirby-v2/panel/commit/5a569d4e3ddaea2b6628d7ec1472a3e8bc410881
• https://github.com/getkirby/kirby/commit/db8f371b13036861c9cc5ba3e85e27f73fce5e09
• https://github.com/getkirby/kirby
• https://github.com/getkirby/kirby/releases/tag/3.4.5
• https://packagist.org/packages/getkirby/cms
• https://packagist.org/packages/getkirby/panel

CVE-2020-26255 · published 2020-12-08T14:42:08Z · modified 2026-09-10T03:48:59.944013053Z · JSON