CVE-2026-104890
Received Received - Intake

PHP File Upload Bypass in Kunstmaan CMS

Publication date: 2026-10-05

Last updated on: 2026-10-05

Assigner: GitHub, Inc.

Description
Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-10-05
Last Modified
2026-10-05
Generated
2026-10-05
AI Q&A
2026-10-05
EPSS Evaluated
N/A
NVD
CVE-2026-104890
EUVD
EUVD-2026-92446

Affected Vendors & Products

Showing 3 associated CPEs
Vendor Product Version / Range
Kunstmaan KunstmaanBundlesCMS < 7.3.1
kunstmaan bundles-cms < 7.3.1
kunstmaan media-bundle < 7.3.1

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-434 The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

Kunstmaan CMS versions before 7.3.2 had a flaw in file upload handling where executable extensions like PHP were checked case-sensitively. An attacker could upload a file with a mixed-case extension (e.g., webshell.pHp) which bypassed the blacklist check. The system then lowercased the extension, storing it as an executable .php file in a web-accessible directory, enabling remote code execution.

Detection Guidance

Check for uploaded files with mixed-case executable extensions (e.g., .pHp, .PhP) in the public/uploads/media/ directory. Use commands like 'find public/uploads/media/ -type f -iname "*.pHp"' or 'ls -la public/uploads/media/ | grep -i ".php"' to identify suspicious files.

Impact Analysis

An authenticated backend user with media access could upload malicious files to execute arbitrary code on the server. This could lead to full system compromise, data theft, or unauthorized access. The impact includes potential loss of confidentiality, integrity, and availability of the system.

Compliance Impact

This vulnerability could lead to unauthorized access or data breaches, violating GDPR's integrity and confidentiality requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, reputational damage, and loss of trust.

Mitigation Strategies

Upgrade to KunstmaanBundlesCMS version 7.3.2 or later. Disable script execution in the public/uploads/media/ directory via web server configuration. Set the X-Content-Type-Options: nosniff header. Review and remove any existing files with mixed-case executable extensions in upload directories.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-104890. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart