Miggo Logo
Miggo Vulnerability Database
→
CVE-2020-26255

CVE-2020-26255:
Kirby Panel users could upload PHP Phar archives as content files before v2.5.14 and v3.4.5

6.8

CVSS Score
3.1

Basic Information

CVE ID
CVE-2020-26255
GHSA ID
GHSA-g3h8-cg9x-47qw
EPSS Score
0.77145%
CWE
CWE-434
Published
12/8/2020
Updated
1/11/2023
KEV Status
No
Technology
TechnologyPHP

Technical Details

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:C/C:N/I:H/A:N
Package NameEcosystemVulnerable VersionsFirst Patched Version
getkirby/panelcomposer< 2.5.142.5.14
getkirby/cmscomposer>= 3.0.0, < 3.4.53.4.5

Vulnerability Intelligence
Miggo AIMiggo AI

Miggo AIRoot Cause Analysis

The vulnerability stems from insufficient file type validation in the checkUpload() function. The commit diff shows 'phar' was added to the forbidden extensions array ($forbiddenExtensions) and the extension check condition (str::contains) was updated to include 'phar'. Prior to the patch, this function did not block .phar files, enabling the upload of executable PHP archives. The function's role in file validation directly maps to CWE-434 (Unrestricted Upload of Dangerous File Type), and the patch explicitly addresses this gap.

Vulnerable functions

Only Mi**o us*rs **n s** t*is s**tion

WAF Protection Rules

WAF Rule

### Imp**t *n **itor wit* *ull ****ss to t** Kir*y P*n*l **n uplo** * P*P `.p**r` *il* *n* *x**ut* it on t** s*rv*r. T*is vuln*r**ility is *riti**l i* you mi**t **v* pot*nti*l *tt**k*rs in your *roup o* *ut**nti**t** P*n*l us*rs, *s t**y **n **in **

Reasoning

T** vuln*r**ility st*ms *rom insu**i*i*nt *il* typ* v*li**tion in t** `****kUplo**()` *un*tion. T** *ommit *i** s*ows 'p**r' w*s ***** to t** *or*i***n *xt*nsions *rr*y ($*or*i***n*xt*nsions) *n* t** *xt*nsion ****k *on*ition (`str::*ont*ins`) w*s up