in the webassist/kfm/initialize.php file, banned names and extensions are set in these 2 lines:
$kfm->defaultSetting('banned_extensions',array('asp','cfm','cgi','php','php3','php4','php5','phtm','pl','sh','shtm','shtml'));
$kfm->defaultSetting('banned_files',array('thumbs.db','/^\./'));