AIKIDO-2026-737636

TL;DR

The kunstmaan/media-bundle upload handler blacklists dangerous file extensions with a case sensitive regex and only lowercases the extension later when storing the file. An authenticated media-admin user can upload a file named webshell.pHp, which slips past the php/htaccess blacklist and is written to the public upload directory as webshell.php, where the web server executes it. The default blacklist also omits other server executable extensions such as phtml, php5, and phar, widening the same bypass. The fix normalizes the extension before comparing it against the blacklist with in_array(), expands the default blacklist, and adds an opt in allow list.