Threats tagged 'ghsa-p279-5wcv-45vq'

KunstmaanBundlesCMS MediaBundle had a vulnerability allowing authenticated backend users to upload files with dangerous extensions that bypassed a case-sensitive blacklist. This allowed execution of uploaded PHP files via the web server, leading to remote code execution. The issue was fixed in version 7.3.2 by normalizing file extensions before checking, expanding the blacklist, and adding an allow-list option. Existing files on disk with executable extensions should be audited. Workarounds include configuring the web server to prevent script execution in the upload directory.