CVE-2026-104890

High

Description

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2.

SeverityHigh

CVSS7.2

Exploit probability—

ProductKunstmaan/media-bundle

PublishedOct 5, 2026

First seenOct 5, 2026

Weakness typeCWE-434Unrestricted upload of dangerous file type

How to fix

Update

kunstmaan/media-bundle7.3.2 or later
kunstmaan/bundles-cms7.3.2 or later

Affected products

Product	Affected versions	Fixed in
kunstmaan/media-bundlePackagist	v < 7.3.2	7.3.2
kunstmaan/bundles-cmsPackagist	v < 7.3.2	7.3.2

Check your version

Choose the product and enter the version you run to see whether it falls in the affected range.

In the Intelligence 360 plan

Attack Surface Management

See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.