{"action":"Upgrade getkirby/cms to 3.9.8.3 or later.","affected":[{"fixed":"3.9.8.3","introduced":"0"},{"fixed":"3.10.1.2","introduced":"3.10.0"},{"fixed":"4.7.1","introduced":"4.0.0"}],"component":"getkirby/cms","cve_ids":["CVE-2025-31493"],"ecosystem":"Packagist","epss":0.0059,"exploited":false,"fixed_versions":["3.9.8.3","3.10.1.2","4.7.1"],"ghsa_id":"GHSA-x275-h9j4-7p4h","id":"tcs_01M5KFAGPGDPJDQE3XY0P1EKVR","modified_at":"2025-05-13T20:12:27.495942Z","published_at":"2025-05-13T20:02:17Z","references":["https://osv.dev/vulnerability/GHSA-x275-h9j4-7p4h","https://github.com/getkirby/kirby/security/advisories/GHSA-x275-h9j4-7p4h","https://nvd.nist.gov/vuln/detail/CVE-2025-31493","https://github.com/getkirby/kirby/commit/95a51480a426a8ed0df799cc017403be9b987ced","https://github.com/getkirby/kirby","https://github.com/getkirby/kirby/releases/tag/3.10.1.2","https://github.com/getkirby/kirby/releases/tag/3.9.8.3","https://github.com/getkirby/kirby/releases/tag/4.7.1"],"severity":{"label":"critical","score":9.1},"sources":[{"source":"osv","source_id":"GHSA-x275-h9j4-7p4h","url":"https://osv.dev/vulnerability/GHSA-x275-h9j4-7p4h"},{"source":"nvd","source_id":"CVE-2025-31493","url":"https://nvd.nist.gov/vuln/detail/CVE-2025-31493"}],"summary":"Kirby vulnerable to path traversal of collection names during file system lookup"}