File disclosure and PHP execution via snippet traversal

Path traversal in Content Folder Kirby allows remote attackers to access server files outside the snippets root through dynamic names. The snippet() helper and $kirby->snippet() method resolve untrusted names containing ../ or slash separators without confirming that the resulting path remains beneath the configured snippets root. A site must pass request- or user-controlled data into a dynamic snippet name; successful traversal can disclose PHP-readable files and execute PHP code found at the selected path.