AIKIDO-2026-245360

TL;DR

MoonShine's FileModelApply::store() re-checks the MIME-derived extension of an uploaded file but never validates the extension of the final stored filename when a File/Image field uses keepOriginalFileName() or a customName() callback. A file detected as an allowed type, such as an image, can be persisted under a disallowed executable extension such as .php by controlling the original or custom filename, bypassing an explicitly configured allowedExtensions() list. On a deployment where the storage disk is web-accessible and the server executes the stored file type, this leads to remote code execution. The fix validates the extension of the actual stored name via storeAs() before saving.