جزئیات آسیب‌پذیری
CVE-2026-104890
Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution
شرح رسمی (انگلیسی)
Kunstmaan CMS is an open source content management system based on the Symfony framework. Prior to 7.3.2, src/Kunstmaan/MediaBundle/Helper/File/FileHandler.php performs the blacklisted_extensions check case-sensitively in FileHandler::getFilePath and lowercases the stored extension afterward. An authenticated backend user with media access can upload a mixed-case executable extension such as PHP that bypasses the check and is stored in the web-accessible media directory with an executable lowercase extension. The default blacklist also omits several server-executable extension types, allowing the same code-execution impact where the web server executes uploaded files. This issue is fixed in version 7.3.2.
امتیازهای CVSS
| امتیاز | نسخه | منبع | بردار |
|---|---|---|---|
| 7.2بالا | 3.1 | CVEProject cvelistV5 (CNA) (GitHub_M) | CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H |
محصولات آسیب‌پذیر
| فروشنده | محصول | نسخه‌ها | منبع |
|---|---|---|---|
| Kunstmaan | KunstmaanBundlesCMS | < 7.3.1 | CVEProject cvelistV5 (CNA) |
| Kunstmaan | bundles-cms | < 7.3.1 | CVEProject cvelistV5 (CNA) |
| Kunstmaan | media-bundle | < 7.3.1 | CVEProject cvelistV5 (CNA) |
منابع و راهنماها
۳- https://github.com/Kunstmaan/KunstmaanBundlesCMS/security/advisories/GHSA-p279-5wcv-45vq x_refsource_CONFIRM
- https://github.com/Kunstmaan/KunstmaanBundlesCMS/commit/1bbdfdeac8e7e91506b1a9271360b9b68d7690d3 x_refsource_MISC
- https://github.com/Kunstmaan/KunstmaanBundlesCMS/releases/tag/7.3.2 x_refsource_MISC
اطلاعات
- تاریخ انتشار
- ۱۴۰۵/۰۷/۱۳
- آخرین به‌روزرسانی
- ۱۴۰۵/۰۷/۱۶
- وضعیت
- منتشرشده
- صادرکننده (CNA)
- GitHub_M
پیش‌بینی بهره‌برداری (EPSS)
ارزیابی SSVC (CISA)
- قابل خودکارسازی
- خیر
- وضعیت بهره‌برداری
- ندارد
- اثر فنی
- کامل
ضعف‌ها (CWE)
- CWE-434Unrestricted Upload of File with Dangerous Type