CVE-2026-104890 Kunstmaan CVE debrief

Who should care

Administrators and developers using Kunstmaan CMS versions before 7.3.2 should assess exposure and prioritize updating to prevent potential remote code execution. This vulnerability allows an attacker to execute arbitrary code on the server, which can lead to a complete compromise of the system. The fix in version 7.3.2 prevents the bypass of the MediaBundle extension blacklist, ensuring that only authorized file types can be uploaded.

Why it matters

CVE-2026-104890 is a high-severity vulnerability in Kunstmaan CMS that allows authenticated administrators to upload executable PHP files, potentially leading to remote code execution. The vulnerability is fixed in version 7.3.2.

• Remote code execution is possible if an authenticated administrator uploads a malicious PHP file.
• The vulnerability allows for potential code execution on the server.
• The fix in version 7.3.2 prevents the bypass of the MediaBundle extension blacklist.

Technical summary

The Kunstmaan CMS MediaBundle extension blacklist bypass vulnerability allows authenticated administrators to upload executable PHP files, potentially leading to remote code execution. The vulnerability is caused by a case-sensitive check in the FileHandler class, which allows an attacker to bypass the blacklist by uploading a file with a mixed-case executable extension. The vulnerability is fixed in version 7.3.2, which prevents the bypass of the MediaBundle extension blacklist. Administrators should prioritize updating to this version or later to prevent potential remote code execution.

Defensive priority

Administrators should prioritize updating Kunstmaan CMS to version 7.3.2 or later to prevent potential remote code execution.

Recommended defensive actions

• Update Kunstmaan CMS to version 7.3.2 or later
• Restrict media upload permissions to prevent authenticated administrators from uploading malicious files
• Monitor for suspicious media uploads and system activity
• Review compensating controls for exposed systems while remediation is scheduled and verified
• Check relevant monitoring, detection, and logs for exposed assets that need extra review
• Track exceptions, retest remediated assets, and close the item only after evidence is documented
• Confirm whether affected product deployments exist in managed environments and assign an owner for follow-up

Evidence notes

The CVE record and source item provide details on the vulnerability, including the affected versions and the fix in version 7.3.2. The vulnerability is a high-severity issue that allows authenticated administrators to upload executable PHP files, potentially leading to remote code execution. The source item and CVE record confirm that the vulnerability is fixed in version 7.3.2, and administrators should assess exposure and prioritize updating to prevent potential remote code execution.

Sources and references

Methodology and review provenance

AI-assisted synthesis based on stored public vulnerability evidence. System validation, approval state, and publication status do not by themselves establish human review of this revision. PatchSiren helps prioritize defensive review and does not prove exposure or remediation on any system.