[HIGH] Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

PKSA-c8mp-7f4z-q7q5 CVE-2026-104890 GHSA-p279-5wcv-45vq

Affected package: kunstmaan/bundles-cms

Affected version: <7.3.2

Reported by:
GitHub