Bundles-CMS (< 7.3.2)

An authentication-required blacklist bypass vulnerability in the Kunstmaan MediaBundle allows malicious administrators to upload arbitrary executable files via case-sensitive extension filtering, resulting in remote code execution.