CVE-2026-104890 in Media Bundle
Summary
by MITRE • 10/05/2026
Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2.
If you want to get best quality of vulnerability data, you may have to visit VulDB.
Analysis
by VulDB Data Team • 10/05/2026
Kunstmaan CMS, a content management system built upon the Symfony framework, contains a critical security vulnerability related to file upload handling within its Media Bundle. The flaw resides specifically in the FileHandler class, which manages the processing and storage of uploaded media files. Prior to version 7.3.2, the logic governing extension validation exhibits a significant inconsistency between how extensions are checked against the blacklist and how they are stored on disk. This discrepancy creates an opportunity for authenticated backend users with access to the media management interface to bypass security controls designed to prevent the upload of executable scripts.
The technical root cause is a case-sensitivity mismatch in the FileHandler::getFilePath method. When a user uploads a file, the system checks if the file extension appears on a predefined blacklist of dangerous extensions. However, this check is performed using a case-sensitive comparison against the original filename provided by the client. Immediately following this validation step, the system lowercases the stored extension before saving the file to the web-accessible media directory. This means that an attacker can upload a PHP script with a mixed-case or uppercase extension, such as .PhP or .PHP. The case-sensitive blacklist check fails to recognize these variations as dangerous because it does not normalize the input string prior to comparison. Consequently, the validation passes, and the file is saved with its original casing if that logic applies, or more critically, the system may store it in a way that preserves executability depending on server configuration, but the primary bypass mechanism relies on the fact that many web servers are case-insensitive regarding extensions like .php, .phtml, or .cgi. Even if the stored extension is lowercased by some internal logic not fully detailed here, the initial bypass allows files with non-standard casing to enter the pipeline where they might evade other checks or exploit server-specific behaviors that treat various casings of executable extensions as scripts rather than static content.
Furthermore, the vulnerability is compounded by an incomplete blacklist configuration in the default settings. The standard list of blocked file extensions omits several types of server-executable formats beyond PHP. This oversight means that even if a user attempts to upload files with other dangerous extensions such as ASP, JSP, CGI, or SHTML, they may succeed if those specific extensions are not explicitly listed in the configuration. When these files land in a web-accessible directory and the underlying web server is configured to execute them based on file type detection rather than just extension matching, arbitrary code execution becomes possible. This transforms what should be a simple media upload feature into a remote code execution vector for any authenticated user with media privileges.
The operational impact of this vulnerability is severe, as it allows attackers to achieve Remote Code Execution (RCE) on the target server. By uploading and subsequently accessing these malicious scripts through their URLs in the public media directory, an attacker can run arbitrary commands with the permissions of the web server process. This typically leads to full system compromise, including data exfiltration, installation of backdoors, pivoting into internal networks, or defacement of the website. The attack requires authentication and specific backend access rights, which limits the threat surface compared to unauthenticated vulnerabilities but remains critical for any organization where user accounts might be compromised through phishing, credential stuffing, or other means.
To mitigate this risk, organizations running Kunstmaan CMS versions prior to 7.3.2 must upgrade immediately to version 7.3.2 or later, which corrects the case-sensitivity logic and ensures consistent handling of file extensions during validation and storage. In addition to upgrading, administrators should review their web server configurations to ensure that directories containing user-uploaded media are strictly configured not to execute scripts. This can be achieved by disabling script execution for specific MIME types in Apache or Nginx configuration files serving the media directory. It is also recommended to implement a robust file upload validation strategy that normalizes all extensions to lowercase before performing blacklist checks and to maintain an exhaustive list of blocked executable extensions including but not limited to php, phtml, phar, asp, aspx, jsp, jspx, cgi, pl, py, rb, sh, bat, cmd.
From a classification perspective, this vulnerability aligns with CWE-434, which describes the Unrestricted Upload of File with Dangerous Type. The failure to properly validate file types before storage allows attackers to upload files that can be executed by the server. Additionally, it relates to CWE-20, Improper Input Validation, as the system fails to correctly sanitize and normalize user-supplied input (the filename extension) prior to security-critical decisions. In terms of attack tactics, this vulnerability facilitates the ATT&CK technique T1505.003, Server Side Scripting, where attackers upload malicious scripts to gain a foothold on the target system. The exploitation path also touches upon T1059, Command and Scripting Interpreter, as the uploaded script is used to execute arbitrary commands on the host operating system.