Read the docs
TI-2026-67742 Aliases CVE-2026-104890GHSA-p279-5wcv-45vq

Blacklist bypass in Kunstmaan CMS lets backend users upload PHP files

Priority LOW 34CWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA and GitHub. Impact type from CWE-434.

Summary

Kunstmaan CMS prior to 7.3.2 has a file upload check that is case sensitive, so a backend user with media access can upload a file with a mixed case executable extension such as PHP. The file is stored in the web accessible media directory with a lowercase extension, and the default blacklist also omits several server executable types. This unrestricted upload of a dangerous file type (CWE-434) lets an authenticated attacker run code on the server where the web server executes uploaded files.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

Description from the CNA

Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00416 36th percentileScored 2026-11-07
Fix Fixed KunstmaanBundlesCMS (Kunstmaan): 7.3.1bundles-cms (kunstmaan): 7.3.1+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
KunstmaanKunstmaanBundlesCMSbefore 7.3.17.3.1Patch availableCNA
Kunstmaanbundles-cmsbefore 7.3.17.3.1Patch availableCNA
Kunstmaanmedia-bundlebefore 7.3.17.3.1Patch availableCNA
—kunstmaan/media-bundle (Packagist)before 7.3.27.3.2Patch availableGHSA-p279-5wcv-45vq
—kunstmaan/bundles-cms (Packagist)before 7.3.27.3.2Patch availableGHSA-p279-5wcv-45vq
  • KunstmaanBundlesCMS VendorKunstmaan Affected before 7.3.1 Fixed in 7.3.1 Patch available CNA
  • bundles-cms VendorKunstmaan Affected before 7.3.1 Fixed in 7.3.1 Patch available CNA
  • media-bundle VendorKunstmaan Affected before 7.3.1 Fixed in 7.3.1 Patch available CNA
  • kunstmaan/media-bundle (Packagist) Vendor— Affected before 7.3.2 Fixed in 7.3.2 Patch available GHSA-p279-5wcv-45vq
  • kunstmaan/bundles-cms (Packagist) Vendor— Affected before 7.3.2 Fixed in 7.3.2 Patch available GHSA-p279-5wcv-45vq

Remediation

Upgrade kunstmaan/media-bundle and kunstmaan/bundles-cms on Packagist to 7.3.2. The sources list no fixed version for KunstmaanBundlesCMS.

Written with Claude Haiku 5.5 from the sources below · 2026-10-29

  • Fix · CNA KunstmaanBundlesCMS (Kunstmaan) Fixed in 7.3.1
  • Fix · CNA bundles-cms (kunstmaan) Fixed in 7.3.1
  • Fix · CNA media-bundle (kunstmaan) Fixed in 7.3.1
  • Fix · GHSA-p279-5wcv-45vq kunstmaan/media-bundle (Packagist) Fixed in 7.3.2 Advisory →
  • Fix · GHSA-p279-5wcv-45vq kunstmaan/bundles-cms (Packagist) Fixed in 7.3.2 Advisory →

Timeline

  1. 2026-10-05 Threatist record created from CVE-2026-104890
  2. 2026-10-07 Priority changed: MEDIUM → LOW
  3. 2026-10-07 Alias added: GHSA-p279-5wcv-45vq
  4. 2026-10-07 Fix available: Packagist/kunstmaan/[email protected], Packagist/kunstmaan/[email protected] · GHSA-p279-5wcv-45vq
  5. 2026-10-07 CVSS score added · GHSA-p279-5wcv-45vq
  6. 2026-10-07 Weakness changed · GHSA-p279-5wcv-45vq
  7. 2026-10-07 5 new references · GHSA-p279-5wcv-45vq
  8. 2026-10-07 CISA SSVC decision points changed

References

Advisory 1

Other 4

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences