Weave Code
Code Weaver
Helps Laravel developers discover, compare, and choose open-source packages. See popularity, security, maintainers, and scores at a glance to make better decisions.
Feedback
Share your thoughts, report bugs, or suggest improvements.
Subject
Message

Bundles Cms Laravel Package

kunstmaan/bundles-cms

Kunstmaan CMS is a full-featured, multilingual CMS built on the Symfony full-stack framework. It offers page and form assembly, versioning, workflow, translation tools, and media management, plus integrations with community bundles.

View on GitHub
Deep Wiki
Context7
7.3.1

Thanks to @t1nonymous for reporting the security issue and for the verification of the patch!


https://github.com/Kunstmaan/KunstmaanBundlesCMS/security/advisories/GHSA-j376-w3x3-q674

Public form file uploads (the FileUploadPagePart) are now restricted to an allow-list of file types, and the stored file extension is always derived from the uploaded file's content instead of the client-supplied file name. This closes an unauthenticated arbitrary file upload (stored XSS / potential RCE where public/ executes PHP).

The default allow-list contains common document and image types (pdf, doc(x), xls(x), ppt(x), odt/ods/odp, txt, csv, rtf, jpg/jpeg, png, gif, webp, avif, jxl, zip). Dangerous types such as php, html and svg are intentionally excluded. If your forms rely on other file types, extend the list via configuration:

kunstmaan_form:
    file_upload:
        allowed_extensions:
            - pdf
            - jpg
            # ...

As additional hardening it is still strongly recommended to serve the public/uploads/formsubmissions/ directory with script execution disabled and with a Content-Disposition: attachment + X-Content-Type-Options: nosniff response. Check your websites for invalid uploads and apply the above mentioned mitigations.

7.3.0
7.2.1
7.1.4
6.4.4
  • [DashboardBundle] Backport #3372 to 6.4
7.2.0
7.1.3
7.1.2
7.0.5

Last bugfix release of the 7.0 version

6.4.3

Last bugfix release of the 6.4 version

7.1.1
7.0.4
6.4.2
7.1.0

7.1.0-alpha2

7.1.0-alpha1

7.0.3
6.4.1
7.0.2
7.1.0-alpha2
7.0.1
7.1.0-alpha1
7.0.0
6.4.0
6.4.0-alpha2

Previous alpha tag was missing some 6.4 changes, this tag contains all correct changes

7.0.0-alpha1
6.4.0-alpha1
6.3.1
6.3.0
6.2.5
6.2.4
6.1.9

This is the last 6.1 bugfix release

6.2.3
Weaver

How can I help you explore Laravel packages today?

Conversation history is not saved when not logged in.
Prompt
Add packages to context
No packages found.
andydefer/laravel-cluster
testo/fiber
mintobit/jobqueue
a4sex/maintenance-bundle
a4sex/entity-date-update
a4sex/client-identifier
a4sex/base-utilites
a4sex/key-value-storage
a4sex/micro-status
chilldev/dependency-injection-extra
datinglibre/datinglibre-app-api
biberltd/corebundle
bricre/symfony-bundle-test
biberltd/logbundle
dominium/http-adapter-bundle
dominium/google-analytics
a4sex/auto-clean-entity
christhompsontldr/laravel-inky
spatie/mailcoach-vapor
spatie/laravel-javascript-views