High, CVSS 7.2PackagistAmendedPublished
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
CVE-2026-104890 · GHSA-p279-5wcv-45vq
- Affected
- Packagist kunstmaan/bundles-cms < 7.3.2
- Fixed in
- 7.3.2· Vendor fix available
- Issue
- The MediaBundle blocks dangerous upload extensions with a blacklist that was matched case-sensitively, while the stored filename was lowercased afterwards. A file uploaded as webshell.pHp therefore bypassed the blacklist and was written to the web-accessible upload directory as webshell.php, where the web server executed it. Any authenticated backend user with access to the media section could obtain remote code execution. Details FileHandler::getFilePath() rewrote blacklisted extensions to .txt using a case-sensitive regex, and only then lowercased the extension when building the stored name — so the check ran against the attacker-controlled casing and the normalisation happened after it. Two further weaknesses contributed: The default blacklist contained only php and htaccess, leaving other server-executable extensions (phtml, php5, phar, shtml, cgi, …) unblocked regardless of casing. Configured blacklist values were interpolated into the regex unescaped. Impact An…
Recommended action: Upgrade to 7.3.2 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.