Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2.

Affected: Packagist: kunstmaan/media-bundle, Packagist: kunstmaan/bundles-cms

### Summary

The MediaBundle blocks dangerous upload extensions with a blacklist that was matched case-sensitively, while the stored filename was lowercased afterwards. A file uploaded as `webshell.pHp` therefore bypassed the blacklist and was written to the web-accessible upload directory as `webshell.php`, where the web server executed it. Any authenticated backend user with access to the media section could obtain remote code execution.

### Details

`FileHandler::getFilePath()` rewrote blacklisted extensions to `.txt` using a case-sensitive regex, and only then lowercased the extension when building the stored name — so the check ran against the attacker-controlled casing and the normalisation happened after it.

Two further weaknesses contributed:

* The default blacklist contained only `php` and `htaccess`, leaving other server-executable extensions (`phtml`, `php5`, `phar`, `shtml`, `cgi`, …) unblocked regardless of casing. * Configured blacklist values were interpolated into the regex unescaped.

### Impact

An authenticated user with access to the admin media section can upload a file that the web server executes as PHP. The uploaded file is reachable over HTTP without authentication, giving arbitrary code execution as the web server user.

### Patches

Fixed in kunstmaan/media-bundle 7.3.2. The extension is now normalised before it is checked and compared with `in_array()`; the default blacklist is expanded to the full set of server-executable extensions; and a…