CVE-2024-26483

  1. OpenCVE
  2. Vulnerabilities (CVE)
  3. CVE-2024-26483
An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.

8.8 /10

CVSS v3 : HIGH

V3 Legend

Vector :

Exploitability : 2.8 / Impact : 5.9

Attack Vector NETWORK

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

References
Link Resource
https://github.com/getkirby/kirby/security/advisories/GHSA-xrvh-rvc4-5m43 Third Party Advisory
https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Unrestricted-File-Upload-dc60ce3132f04442b73f2dba2631fae0?pvs=4 Exploit Third Party Advisory
https://github.com/getkirby/kirby/security/advisories/GHSA-xrvh-rvc4-5m43 Third Party Advisory
https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Unrestricted-File-Upload-dc60ce3132f04442b73f2dba2631fae0?pvs=4 Exploit Third Party Advisory
Configurations

Configuration 1 (hide)

OR cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
cpe:2.3:a:getkirby:kirby:3.10.0:*:*:*:*:*:*:*
History

08 Apr 2025, 14:35

Type Values Removed Values Added
CPE cpe:2.3:a:getkirby:kirby:3.10.0:*:*:*:*:*:*:*
cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*
First Time Getkirby kirby
Getkirby
References () https://github.com/getkirby/kirby/security/advisories/GHSA-xrvh-rvc4-5m43 - () https://github.com/getkirby/kirby/security/advisories/GHSA-xrvh-rvc4-5m43 - Third Party Advisory
References () https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Unrestricted-File-Upload-dc60ce3132f04442b73f2dba2631fae0?pvs=4 - () https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Unrestricted-File-Upload-dc60ce3132f04442b73f2dba2631fae0?pvs=4 - Exploit, Third Party Advisory

21 Nov 2024, 09:02

Type Values Removed Values Added
References () https://github.com/getkirby/kirby/security/advisories/GHSA-xrvh-rvc4-5m43 - () https://github.com/getkirby/kirby/security/advisories/GHSA-xrvh-rvc4-5m43 -
References () https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Unrestricted-File-Upload-dc60ce3132f04442b73f2dba2631fae0?pvs=4 - () https://shrouded-trowel-50c.notion.site/Kirby-CMS-4-1-0-Unrestricted-File-Upload-dc60ce3132f04442b73f2dba2631fae0?pvs=4 -

01 Aug 2024, 13:48

Type Values Removed Values Added
CVSS v2 : unknown
v3 : unknown 		v2 : unknown
v3 : 8.8
CWE CWE-94

12 Mar 2024, 05:15

Type Values Removed Values Added
References
  • () https://github.com/getkirby/kirby/security/advisories/GHSA-xrvh-rvc4-5m43 -

22 Feb 2024, 19:07

Type Values Removed Values Added
Summary
  • (es) Una vulnerabilidad de carga de archivos arbitrarios en el módulo Imagen de perfil de Kirby CMS v4.1.0 permite a los atacantes ejecutar código arbitrario a través de un archivo PDF manipulado.

22 Feb 2024, 05:15

Type Values Removed Values Added
New CVE
Information

Published : 2024-02-22 05:15

Updated : 2025-04-08 14:35

NVD link : CVE-2024-26483

Mitre link : CVE-2024-26483

CVE.ORG link : CVE-2024-26483

JSON object : View

Products Affected

getkirby

  • kirby
CWE
CWE-94

Improper Control of Generation of Code ('Code Injection')