VYPR
← All advisories
High severity8.8NVD Advisory· Published Feb 22, 2024· Updated Jun 17, 2026

CVE-2024-26483

CVE-2024-26483

Description

An arbitrary file upload vulnerability in the Profile Image module of Kirby CMS v4.1.0 allows attackers to execute arbitrary code via a crafted PDF file.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
getkirby/cmsPackagist
< 3.6.6.53.6.6.5
getkirby/cmsPackagist
>= 3.7.0, < 3.7.5.43.7.5.4
getkirby/cmsPackagist
>= 3.8.0, < 3.8.4.33.8.4.3
getkirby/cmsPackagist
>= 3.9.0, < 3.9.8.13.9.8.1
getkirby/cmsPackagist
>= 3.10.0, < 3.10.0.13.10.0.1
getkirby/cmsPackagist
>= 4.0.0, < 4.1.14.1.1

Affected products

4
  • Getkirby/Kirby2 versions
    cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*+ 1 more
    • cpe:2.3:a:getkirby:kirby:*:*:*:*:*:*:*:*range: <3.6.6.5
    • cpe:2.3:a:getkirby:kirby:3.10.0:*:*:*:*:*:*:*
  • Kirby/CMSdescription
  • ghsa-coords
    pkg:composer/getkirby/cms
    Range: < 3.6.6.5

Patches

Vulnerability mechanics

References

4

News mentions

0

No linked articles in our index yet.