Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
High · CVSS 7.2
### Summary The MediaBundle blocks dangerous upload extensions with a blacklist that was matched case-sensitively, while the stored filename was lowercased afterwards. A file uploaded as `webshell.pHp` therefore bypassed the blacklist and was written to the web-accessible upload directory as `webshell.php`, where the web server executed it. Any authenticated backend user with access to the media section could obtain remote code execution.
Remediation
Upgrade kunstmaan/media-bundle to 7.3.2 or later. Upgrade kunstmaan/bundles-cms to 7.3.2 or later.
Affected PHP branches
See the source advisory.
Source: GitHub Global Security Advisories (Composer ecosystem) · retrieved 2026-10-22T10:19:14-04:00 · https://github.com/advisories/GHSA-p279-5wcv-45vq