AIKIDO-2026-345389

TL;DR

MediaUploader accepts uploaded filenames containing an embedded dangerous extension such as shell.php.jpg, and File::sanitizeFileName() only strips characters outside a safe set without removing forbidden extensions nested inside the name. Extension, MIME type, and aggregate type checks all pass because the outer .jpg extension satisfies validation while the inner .php extension survives sanitization intact. On a server configured to execute any filename containing .php as PHP, the stored upload runs as executable code. The fix extends sanitizeFileName() to strip a dot immediately before any forbidden extension found anywhere in the filename.