CVE-2025-31493 is a Critical severity (CVSS 9.1) path traversal in Kirby CMS. Sites are affected only if they call the collection helper with a name that depends on request or user data. Update to 3.9.8.3, 3.10.1.2 or 4.7.1, or any later release.
What's affected
Kirby's advisory says versions before 3.9.8.3, 3.10.1.2 and 4.7.1 are affected, and patched releases are Kirby 3.9.8.3, Kirby 3.10.1.2 and Kirby 4.7.1. Update to one of these or a later version.
The flaw only affects sites that use the collection() helper or the $kirby->collection() method with a dynamic collection name, such as a name built from request or user data. Sites that only call these with a fixed string name are not affected, according to the advisory.
The weaknesses listed are CWE-22 and CWE-23. The record scores it 9.1 Critical with the vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N. Kirby's own advisory rates it Moderate at CVSS 6.3 using the newer v4 scoring, and explains why: an attack first needs a code pattern in the site that uses dynamic names, and generally also needs knowledge of the site structure and server file system. The record does not mark the CVE as in CISA KEV.
How to check if you're exposed
First find your Kirby version. With Composer:
composer show getkirby/cms
Or from the Kirby Panel's system area. Compare the result with the patched releases for your line. Then check whether your code uses dynamic collection names. Search your templates, plugins and controllers:
grep -rn "collection(" site/ --include=*.php
Read each match. A call like collection('articles') with a fixed string is not affected. A call that joins a request value into the name, for example a name built from a query parameter, is the pattern the advisory warns about.
This is a good case for reachability thinking. The package version tells you whether the library is old. Your code tells you whether it can actually be hit. You need both answers before you rank it against other work, though updating is cheap enough that you should do it either way.
What to do now
- Update Kirby to 3.9.8.3, 3.10.1.2, 4.7.1 or any later release, using
composer update getkirby/cmsor the Kirby update process you use. - Search your code for calls to
collection()with names built from request or user data, and replace them with a fixed allowlist of names. - Until you update, validate any value used in a collection name against an explicit list of allowed values.
- Check that the PHP process on your server can read only the files it needs, so any traversal reaches less.
- Review logs for requests with unusual path sequences in parameters that feed collection names, and treat hits as leads for investigation.
Why it matters
Path traversal means a program builds a file path from outside input and does not confirm the result stays inside the intended folder. The special sequence for the parent directory is the usual tool. Kirby's collection helper did not check the final path, so a crafted name could point outside the collections folder, even outside the Kirby installation.
The advisory notes a detail that raises the stakes: PHP code in the files that were reached was executed. That turns a file read problem into a possible code execution problem. The fix adds a check that the resulting path is inside the configured collections root, and paths outside it are not loaded. Note that the CVSS scores in the two sources differ, 9.1 in the record and 6.3 from the vendor. The gap comes from different scoring versions and assumptions about how common the vulnerable code pattern is. Use the vendor's context to judge your own risk, and treat updating as the sure step.
Try it yourself
Click through it at your own pace, or open it full screen.
Quick check
Is my Kirby site affected if I use collection() with fixed names?
Kirby's advisory says sites that only use fixed string names are not affected. The risk is limited to dynamic names that depend on request or user data.
Why do the severity scores differ?
The record shows 9.1 Critical using CVSS 3.1, while Kirby's advisory shows 6.3 Moderate using CVSS 4. Kirby also notes the attack needs a specific code pattern in the site.
Sources
Last reviewed: 19 October 2026.
