file upload
3 articles with this tag
CVE-2026-48939 — Unauthenticated upload to RCE in iCagenda (Joomla): explainer & fixes
iCagenda (Joomla events-calendar extension) 3.2.1–3.9.14 and 4.0.0–4.0.7 has an unauthenticated arbitrary file upload → RCE (CVSS 10.0, in CISA KEV). Access control on the public event-registration form's attachment handler was reportedly enforced only at the view layer, not the controller. The real fix is updating to 3.9.15 or 4.0.8, plus a compromise check. The durable defense is designing out the 'unauthenticated upload → RCE' pattern.
File upload vulnerabilities — preventing web shells and RCE by design
The core of an upload hole isn't 'receiving a file' — it's where you put it and whether it can execute. Unauthenticated endpoint + no type validation + stored under the web root + scripts run there = web shell → RCE. Defend in layers: (1) auth/permission + CSRF on the endpoint, (2) server-side allow-list + content inspection, (3) store outside the web root (or disable execution), (4) randomize names, never trust user paths. Not one wall — a stop at every step.
CVE-2026-48908 — Unauthenticated upload to RCE in SP Page Builder (Joomla): explainer & fixes
SP Page Builder for Joomla (by JoomShaper) ≤ 6.6.1 has an unauthenticated arbitrary file upload → RCE (CVSS 10.0, in CISA KEV). The custom-icon upload reportedly ran no auth or type validation. The real fix is updating to 6.6.2, plus a compromise check (rogue admins, web shells). The durable defense is designing out the 'unauthenticated upload → RCE' pattern.