Kunstmaanbundlescms
Monthly
Authenticated code execution via media upload in Kunstmaan CMS (KunstmaanBundlesCMS) before 7.3.2: the MediaBundle checks the file-extension blacklist case-sensitively but lowercases the extension before writing the file, so a backend user with media-upload rights can submit a file named e.g. webshell.pHp, slip past the blacklist, and have it stored as webshell.php inside the web-accessible media directory. Impact escalates to full remote code execution, but only where the web server is configured to execute scripts in public/uploads/media/ - the vendor's hardening guidance (disable script execution for that path, send X-Content-Type-Options: nosniff) removes the execution impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the flaw is gated behind a valid media-role account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.2).
Authenticated code execution via media upload in Kunstmaan CMS (KunstmaanBundlesCMS) before 7.3.2: the MediaBundle checks the file-extension blacklist case-sensitively but lowercases the extension before writing the file, so a backend user with media-upload rights can submit a file named e.g. webshell.pHp, slip past the blacklist, and have it stored as webshell.php inside the web-accessible media directory. Impact escalates to full remote code execution, but only where the web server is configured to execute scripts in public/uploads/media/ - the vendor's hardening guidance (disable script execution for that path, send X-Content-Type-Options: nosniff) removes the execution impact. No public exploit code or confirmed in-the-wild exploitation was identified at time of analysis, and the flaw is gated behind a valid media-role account (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H, 7.2).