GHSA-6j4c-mgqr-qv76

### TL;DR

This vulnerability affects all Kirby sites that are deployed in a way that their `index` root on the server is next to a second directory that is read-accessible to PHP and shares the same name prefix (such as the site with the index root `/var/www/site` being next to `/var/www/site2`).

It was possible to create and access thumbnails from media files within such sibling directories that have a valid thumbnail configuration (JSON job file). This can affect staging sites, site backups or other internal sites.

----

### Introduction

A path traversal (also known as directory traversal) vulnerability occurs when untrusted input is used to build a filesystem path without properly confining the result to an intended base directory. By injecting sequences such as `../`, an attacker can escape that directory and reach files elsewhere on the server.

### Affected components

Kirby's media handler processes requests for files in the `media` directory that have not been generated yet. It parses the provided path and finds the correct file or asset to generate a thumbnail of. Each thumbnail needs to have a prepared job file (a metadata file with file extension `.json`) in order to allow the media handler to generate a thumbnail.

The media handler uses filesystem containment checks in several places that are supposed to prevent breakout of the `media` and `index` roots of the site.

### Impact

In affected releases, the containment checks were incomplete and did not cover the case of a sibling directory next to the containment directory that starts with the same prefix. E.g. a directory `site2` passed the containment check of directory `site`. This allowed attackers to access media files with prepared job files that are stored within such sibling directories of the site's `index` root, opening the potential for information leaks from sensitive files stored within them, and deleting the job file in the process.

### Patches

The problem has been patched in [Kirby 4.9.5](https://github.com/getkirby/kirby/releases/tag/4.9.5) and [Kirby 5.5.2](https://github.com/getkirby/kirby/releases/tag/5.5.2). Please update to one of these or a [later version](https://github.com/getkirby/kirby/releases) to fix the vulnerability.

In all of the mentioned releases, we have hardened the containment helpers `Kirby\Filesystem\Dir::realpath()` and `Kirby\Filesystem\F::realpath()` to require either an exact match or a `DIRECTORY_SEPARATOR` boundary, so that a sibling path sharing the same name prefix can no longer pass the check. This prevents access to files outside the `index` root of the active site. We have also hardened the `Asset` class to block paths that contain the `../` sequence.

### Credits

Thanks to @0x1saac for responsibly reporting the identified issue.