https://db.gcve.eu Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Thu, 08 Oct 2026 22:44:40 +0000 https://db.gcve.eu/vuln/fkie_cve-2026-104890 <p>Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2.</p> <p>Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2.</p> https://db.gcve.eu/vuln/fkie_cve-2026-104890 https://db.gcve.eu/vuln/ghsa-p279-5wcv-45vq <p><strong>Affected:</strong> Packagist: kunstmaan/media-bundle, Packagist: kunstmaan/bundles-cms</p> <p>### Summary</p> <p>The MediaBundle blocks dangerous upload extensions with a blacklist that was matched case-sensitively, while the stored filename was lowercased afterwards. A file uploaded as `webshell.pHp` therefore bypassed the blacklist and was written to the web-accessible upload directory as `webshell.php`, where the web server executed it. Any authenticated backend user with access to the media section could obtain remote code execution.</p> <p>### Details</p> <p>`FileHandler::getFilePath()` rewrote blacklisted extensions to `.txt` using a case-sensitive regex, and only then lowercased the extension when building the stored name — so the check ran against the attacker-controlled casing and the normalisation happened after it.</p> <p>Two further weaknesses contributed:</p> <p>* The default blacklist contained only `php` and `htaccess`, leaving other server-executable extensions (`phtml`, `php5`, `phar`, `shtml`, `cgi`, …) unblocked regardless of casing. * Configured blacklist values were interpolated into the regex unescaped.</p> <p>### Impact</p> <p>An authenticated user with access to the admin media section can upload a file that the web server executes as PHP. The uploaded file is reachable over HTTP without authentication, giving arbitrary code execution as the web server user.</p> <p>### Patches</p> <p>Fixed in kunstmaan/media-bundle 7.3.2. The extension is now normalised before it is checked and compared with `in_array()`; the default blacklist is expanded to the full set of server-executable extensions; and a…</p> <p><strong>Affected:</strong> Packagist: kunstmaan/media-bundle, Packagist: kunstmaan/bundles-cms</p> <p>### Summary</p> <p>The MediaBundle blocks dangerous upload extensions with a blacklist that was matched case-sensitively, while the stored filename was lowercased afterwards. A file uploaded as `webshell.pHp` therefore bypassed the blacklist and was written to the web-accessible upload directory as `webshell.php`, where the web server executed it. Any authenticated backend user with access to the media section could obtain remote code execution.</p> <p>### Details</p> <p>`FileHandler::getFilePath()` rewrote blacklisted extensions to `.txt` using a case-sensitive regex, and only then lowercased the extension when building the stored name — so the check ran against the attacker-controlled casing and the normalisation happened after it.</p> <p>Two further weaknesses contributed:</p> <p>* The default blacklist contained only `php` and `htaccess`, leaving other server-executable extensions (`phtml`, `php5`, `phar`, `shtml`, `cgi`, …) unblocked regardless of casing. * Configured blacklist values were interpolated into the regex unescaped.</p> <p>### Impact</p> <p>An authenticated user with access to the admin media section can upload a file that the web server executes as PHP. The uploaded file is reachable over HTTP without authentication, giving arbitrary code execution as the web server user.</p> <p>### Patches</p> <p>Fixed in kunstmaan/media-bundle 7.3.2. The extension is now normalised before it is checked and compared with `in_array()`; the default blacklist is expanded to the full set of server-executable extensions; and a…</p> https://db.gcve.eu/vuln/ghsa-p279-5wcv-45vq