kunstmaan/bundles-cms
Kunstmaan CMS is a full-featured, multilingual CMS built on the Symfony full-stack framework. It offers page and form assembly, versioning, workflow, translation tools, and media management, plus integrations with community bundles.
Thanks to @t1nonymous for reporting the security issue and for the verification of the patch!
https://github.com/Kunstmaan/KunstmaanBundlesCMS/security/advisories/GHSA-j376-w3x3-q674
Public form file uploads (the FileUploadPagePart) are now restricted to an allow-list of file
types, and the stored file extension is always derived from the uploaded file's content
instead of the client-supplied file name. This closes an unauthenticated arbitrary file upload
(stored XSS / potential RCE where public/ executes PHP).
The default allow-list contains common document and image types (pdf, doc(x), xls(x),
ppt(x), odt/ods/odp, txt, csv, rtf, jpg/jpeg, png, gif, webp, avif, jxl, zip).
Dangerous types such as php, html and svg are intentionally excluded. If your forms rely
on other file types, extend the list via configuration:
kunstmaan_form:
file_upload:
allowed_extensions:
- pdf
- jpg
# ...
As additional hardening it is still strongly recommended to serve the public/uploads/formsubmissions/ directory with
script execution disabled and with a Content-Disposition: attachment + X-Content-Type-Options: nosniff response. Check your websites for invalid uploads and apply the above mentioned mitigations.
Last bugfix release of the 7.0 version
Last bugfix release of the 6.4 version
nGram to ngram #3331 ([@delboy1978uk](https://github.com/delboy1978uk))Previous alpha tag was missing some 6.4 changes, this tag contains all correct changes
nGram to ngram #3331 ([@delboy1978uk](https://github.com/delboy1978uk))nGram to ngram #3331 ([@delboy1978uk](https://github.com/delboy1978uk))This is the last 6.1 bugfix release
How can I help you explore Laravel packages today?