What is the CVSS score of CVE-2026-29905?

CVE-2026-29905 has a CVSS 3.1 base score of 6.5 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. EPSS exploitation probability: 0.0%.

Which versions of PHP are affected by CVE-2026-29905?

Organizations using Kirby CMS through 5.1.4 should be aware of notable risk from CVE-2026-29905, a input validation vulnerability rated CVSS 6.5.. A patch is available.

How to fix or mitigate CVE-2026-29905?

Within 30 days: Identify affected systems and apply vendor patches as part of regular patch cycle. Monitor vendor channels for patch availability.

PHP CVE-2026-29905

EUVD-2026-16232 MEDIUM

Improper Input Validation (CWE-20)

2026-03-26 mitre

GHSA-cw7v-45wm-mcf2

PHP Denial Of Service

6.5

CVSS 3.1 · NVD

Severity by source

NVD PRIMARY

6.5 MEDIUM

AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Primary rating from NVD · only source for this CVE.

CVSS VectorNVD

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

None

Availability

High

Lifecycle Timeline

Patch released

Mar 31, 2026 - 21:13 nvd

Patch available

EUVD ID Assigned

Mar 26, 2026 - 16:45 euvd

EUVD-2026-16232

Analysis Generated

Mar 26, 2026 - 16:45 vuln.today

CVE Published

Mar 26, 2026 - 00:00 nvd

MEDIUM 6.5

DescriptionCVE.org

Kirby CMS through 5.1.4 allows an authenticated user with 'Editor' permissions to cause a persistent Denial of Service (DoS) via a malformed image upload. The application fails to properly validate the return value of the PHP getimagesize() function. When the system attempts to process this file for metadata or thumbnail generation, it triggers a fatal TypeError.

AnalysisAI

Kirby CMS versions through 5.1.4 allow authenticated editors to trigger a persistent denial of service by uploading malformed images that bypass getimagesize() validation, causing fatal TypeErrors during metadata or thumbnail processing. A proof-of-concept exists and the vulnerability is automatable post-authentication, though no CISA KEV confirmation is evident. The impact is availability degradation affecting CMS operations for all users.

Technical ContextAI

The vulnerability stems from improper input validation (CWE-20: Improper Input Validation) in Kirby CMS's image processing pipeline. Specifically, the application fails to validate the return value of PHP's getimagesize() function, which can return false or an array depending on input validity. When getimagesize() encounters a malformed image file, it returns false rather than an expected array structure. Downstream code that assumes a successful return (e.g., accessing array indices for width/height or passing values to image manipulation libraries) triggers a fatal TypeError. This is a server-side PHP vulnerability requiring network access to the Kirby CMS instance, authentication as an Editor-role user, and file upload capability. No CPE string with vendor specificity is available in the provided data, though the affected product is explicitly Kirby CMS.

RemediationAI

Upgrade Kirby CMS to version 5.2.0 or later as soon as it becomes available (the 5.2.0-rc.1 release candidate is available at https://github.com/getkirby/kirby/releases/tag/5.2.0-rc.1). Until patching is feasible, restrict file upload permissions to minimize the set of users who can trigger the vulnerability-limit Editor role assignments to trusted personnel and implement file type validation at the web server level to reject suspicious image uploads before they reach Kirby's processing pipeline. Monitor application logs for PHP TypeErrors related to image processing to detect exploitation attempts. Additionally, consider implementing request rate-limiting on image upload endpoints to reduce DoS impact severity.