CVE-2026-104890: Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
The MediaBundle blocks dangerous upload extensions with a blacklist that was matched
case-sensitively, while the stored filename was lowercased afterwards. A file uploaded
as webshell.pHp therefore bypassed the blacklist and was written to the web-accessible
upload directory as webshell.php, where the web server executed it. Any authenticated
backend user with access to the media section could obtain remote code execution.
References
- github.com/Kunstmaan/KunstmaanBundlesCMS/commit/1bbdfdeac8e7e91506b1a9271360b9b68d7690d3
- github.com/Kunstmaan/KunstmaanBundlesCMS/releases/tag/7.3.2
- github.com/Kunstmaan/KunstmaanBundlesCMS/security/advisories/GHSA-p279-5wcv-45vq
- github.com/advisories/GHSA-p279-5wcv-45vq
- nvd.nist.gov/vuln/detail/CVE-2026-104890
Code Behaviors & Features
Detect and mitigate CVE-2026-104890 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →