[HIGH] Kunstmaan CMS: MediaBundle extension blacklist bypass allows authenticated administrators to upload executable PHP files leading to remote code execution

PKSA-qzt5-rxz6-8qm6 CVE-2026-104890 GHSA-p279-5wcv-45vq

Affected package: kunstmaan/media-bundle

Affected version: <7.3.2

Reported by:
GitHub