CVE-2025-30159 is a critical (CVSS 9.1) path traversal flaw in the Kirby content management system. Sites that call snippet() with a dynamic name are affected. Update to Kirby 3.9.8.3, 3.10.1.2 or 4.7.1, or a later release, and replace dynamic snippet names with an allow list of fixed names.
What's affected
The GitHub advisory lists these affected Kirby versions: up to 3.9.8.2, 3.10.0 through 3.10.1.1, and 4.0.0 through 4.7.0. The package is getkirby/kirby on Composer.
Fixed versions are 3.9.8.3, 3.10.1.2 and 4.7.1.
Only sites that call the snippet() helper or the $kirby->snippet() method with a dynamic snippet name, such as a name built from request or user data, are affected. Sites that only use fixed names, a plain string, are not affected, according to the advisory.
How to check if you're exposed
Two checks: the version, and the code.
- In a Composer managed project, run composer show getkirby/kirby to see the installed version, and compare it with the fixed versions.
- Search your templates, snippets, controllers and plugins for calls to snippet( where the argument is not a plain quoted string. Names that include get(), a URL segment, a field value or any user influenced data deserve review.
- Check your plugins too, as the advisory says the issue affects any use of dynamic names.
Safeguard's free in-browser dependency scan at gold.safeguard.sh/scan can show whether a project's dependency list includes an affected component, and the Gold directory lets you look up the CVE and its related weaknesses.
What to do now
- Update Kirby to 3.9.8.3, 3.10.1.2 or 4.7.1, whichever matches your release line, or to the latest version.
- Review every dynamic snippet() call and replace it with a fixed list of allowed names.
- Test the site and redeploy.
- Check the PHP process permissions. It should only read the files the site needs, and the web root should not hold secrets.
- Review web logs for requests that include unusual path sequences in parameters feeding snippets.
Why it matters
The record maps the flaw to CWE-22 (Path Traversal) and CWE-23 (Relative Path Traversal). Kirby's snippet helper first checks whether a file with the given name exists in the snippets folder. That logic did not check that the resulting path stayed inside the folder, so sequences that point to a parent directory could escape it.
The advisory says PHP code in files reached this way was executed, which is why the severity is high. It adds that an attacker generally needs a dynamic snippet name in the site code and some knowledge of the site structure and server file system, although automated discovery might be possible. The fix adds a check that the final path is contained in the configured snippets root.
The practical lesson is to avoid building file names from user input. A fixed map of allowed values is safer than any filter.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Am I affected if I only use fixed snippet names?
No, according to the advisory. Only dynamic names built from request or user data matter.
Do I need to change my code after updating?
The update adds the check. Still, replacing dynamic names with an allow list is good practice.
Sources
Last reviewed: 19 October 2026.
