Joomla
2 articles with this tag
CVE-2026-48939 — Unauthenticated upload to RCE in iCagenda (Joomla): explainer & fixes
iCagenda (Joomla events-calendar extension) 3.2.1–3.9.14 and 4.0.0–4.0.7 has an unauthenticated arbitrary file upload → RCE (CVSS 10.0, in CISA KEV). Access control on the public event-registration form's attachment handler was reportedly enforced only at the view layer, not the controller. The real fix is updating to 3.9.15 or 4.0.8, plus a compromise check. The durable defense is designing out the 'unauthenticated upload → RCE' pattern.
CVE-2026-48908 — Unauthenticated upload to RCE in SP Page Builder (Joomla): explainer & fixes
SP Page Builder for Joomla (by JoomShaper) ≤ 6.6.1 has an unauthenticated arbitrary file upload → RCE (CVSS 10.0, in CISA KEV). The custom-icon upload reportedly ran no auth or type validation. The real fix is updating to 6.6.2, plus a compromise check (rogue admins, web shells). The durable defense is designing out the 'unauthenticated upload → RCE' pattern.