CVE-2025-30207

{"id": "CVE-2025-30207", "cveTags": [], "metrics": {"cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.5, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 3.9}], "cvssMetricV40": [{"type": "Secondary", "source": "security-advisories@github.com", "cvssData": {"Safety": "NOT_DEFINED", "version": "4.0", "Recovery": "NOT_DEFINED", "baseScore": 2.3, "Automatable": "NOT_DEFINED", "attackVector": "ADJACENT", "baseSeverity": "LOW", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:A/AC:L/AT:P/PR:N/UI:N/VC:N/VI:N/VA:N/SC:L/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "exploitMaturity": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "userInteraction": "NONE", "attackComplexity": "LOW", "attackRequirements": "PRESENT", "privilegesRequired": "NONE", "subIntegrityImpact": "NONE", "vulnIntegrityImpact": "NONE", "integrityRequirement": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "availabilityRequirement": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "subConfidentialityImpact": "LOW", "vulnConfidentialityImpact": "NONE", "confidentialityRequirement": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED"}}]}, "published": "2025-05-13T16:15:29.360", "references": [{"url": "https://github.com/getkirby/kirby/releases/tag/3.10.1.2", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/releases/tag/3.9.8.3", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/releases/tag/4.7.1", "tags": ["Release Notes"], "source": "security-advisories@github.com"}, {"url": "https://github.com/getkirby/kirby/security/advisories/GHSA-9p3p-w5jf-8xxg", "tags": ["Vendor Advisory"], "source": "security-advisories@github.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "security-advisories@github.com", "description": [{"lang": "en", "value": "CWE-22"}, {"lang": "en", "value": "CWE-23"}]}], "descriptions": [{"lang": "en", "value": "Kirby is an open-source content management system. A vulnerability in versions prior to 3.9.8.3, 3.10.1.2, and 4.7.1 affects all Kirby setups that use PHP's built-in server. Such setups are commonly only used during local development. Sites that use other server software (such as Apache, nginx or Caddy) are not affected. A missing path traversal check allowed attackers to navigate all files on the server that were accessible to the PHP process, including files outside of the Kirby installation. The vulnerable implementation delegated all existing files to PHP, including existing files outside of the document root. This leads to a different response that allows attackers to determine whether the requested file exists. Because Kirby's router only delegates such requests to PHP and does not load or execute them, contents of the files were not exposed as PHP treats requests to files outside of the document root as invalid. The problem has been patched in Kirby 3.9.8.3, Kirby 3.10.1.2, and Kirby 4.7.1. In all of the mentioned releases, the maintainers of Kirby have updated the router to check if existing static files are within the document root. Requests to files outside the document root are treated as page requests of the error page and will no longer allow to determine whether the file exists or not."}, {"lang": "es", "value": "Kirby es un sistema de gesti\u00f3n de contenido de c\u00f3digo abierto. Una vulnerabilidad en versiones anteriores a 3.9.8.3, 3.10.1.2 y 4.7.1 afecta a todas las configuraciones de Kirby que utilizan el servidor integrado de PHP. Estas configuraciones suelen utilizarse solo durante el desarrollo local. Los sitios que utilizan otro software de servidor (como Apache, nginx o Caddy) no se ven afectados. La falta de una comprobaci\u00f3n de path traversal permiti\u00f3 a los atacantes navegar por todos los archivos del servidor accesibles para el proceso PHP, incluidos los archivos fuera de la instalaci\u00f3n de Kirby. La implementaci\u00f3n vulnerable deleg\u00f3 todos los archivos existentes a PHP, incluidos los existentes fuera del root del documento. Esto genera una respuesta diferente que permite a los atacantes determinar si el archivo solicitado existe. Dado que el enrutador de Kirby solo delega dichas solicitudes a PHP y no las carga ni las ejecuta, el contenido de los archivos no se expuso, ya que PHP trata las solicitudes a archivos fuera del root del documento como no v\u00e1lidas. El problema se ha corregido en Kirby 3.9.8.3, Kirby 3.10.1.2 y Kirby 4.7.1. En todas las versiones mencionadas, los mantenedores de Kirby han actualizado el enrutador para comprobar si los archivos est\u00e1ticos existentes se encuentran en el root del documento. Las solicitudes a archivos fuera del root del documento se tratan como solicitudes de p\u00e1gina de la p\u00e1gina de error y ya no permiten determinar si el archivo existe o no."}], "lastModified": "2025-08-26T14:44:44.370", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D805FEF9-99CA-4AA8-B7A2-E55F8B6CF633", "versionEndExcluding": "3.9.8.3"}, {"criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "B32EEBCF-2673-485B-9B5D-002D258315CD", "versionEndExcluding": "3.10.1.2", "versionStartIncluding": "3.10.0"}, {"criteria": "cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "22B812FA-29DC-4CE0-9E49-6AC09BA4087D", "versionEndExcluding": "4.7.1", "versionStartIncluding": "4.0.0"}], "operator": "OR"}]}], "sourceIdentifier": "security-advisories@github.com"}