{"action":"Upgrade getkirby/cms to 3.9.8.3 or later.","affected":[{"fixed":"3.9.8.3","introduced":"0"},{"fixed":"3.10.1.2","introduced":"3.10.0"},{"fixed":"4.7.1","introduced":"4.0.0"}],"component":"getkirby/cms","cve_ids":["CVE-2025-30207"],"ecosystem":"Packagist","epss":0.00588,"exploited":false,"fixed_versions":["3.9.8.3","3.10.1.2","4.7.1"],"ghsa_id":"GHSA-9p3p-w5jf-8xxg","id":"tcs_01M5KF06KERTCY9ZAANST4CQY1","modified_at":"2025-05-13T20:12:27.414835Z","published_at":"2025-05-13T20:02:20Z","references":["https://osv.dev/vulnerability/GHSA-9p3p-w5jf-8xxg","https://github.com/getkirby/kirby/security/advisories/GHSA-9p3p-w5jf-8xxg","https://nvd.nist.gov/vuln/detail/CVE-2025-30207","https://github.com/getkirby/kirby/commit/3ebc9ad3f5adcbd4838ce60219f1c9a561231235","https://github.com/getkirby/kirby","https://github.com/getkirby/kirby/releases/tag/3.10.1.2","https://github.com/getkirby/kirby/releases/tag/3.9.8.3","https://github.com/getkirby/kirby/releases/tag/4.7.1"],"severity":{"label":"high","score":7.5},"sources":[{"source":"osv","source_id":"GHSA-9p3p-w5jf-8xxg","url":"https://osv.dev/vulnerability/GHSA-9p3p-w5jf-8xxg"},{"source":"nvd","source_id":"CVE-2025-30207","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-30207"}],"summary":"Kirby vulnerable to path traversal in the router for PHP's built-in server"}