CVE-2026-102427

OrdaSoft Joomla CCK before 8.3.16 has an unauthenticated remote code execution flaw (CWE-434) in site/uploader.php, reachable through normal frontend routing via task=getContent with no authentication or ACL check in the dispatch chain. The handler checks uploaded content with a magic-byte MIME test, but the extension allow-list was commented out, so the saved extension is taken from the attacker-supplied filename and the file is written under the Joomla web root where PHP is executed; an image/PHP polyglot can pass the MIME check while using a .php extension. A remote unauthenticated attacker can thereby place and run PHP of their choosing on the site, with full impact on confidentiality, integrity, and availability. Sites running OrdaSoft Joomla CCK older than 8.3.16 are affected. The CVSS 4.0 vector records exploit maturity as Attacked (E:A, score 10); the issue is not in CISA KEV and no public proof-of-concept is known.

What to do: Upgrade OrdaSoft Joomla CCK to version 8.3.16 or later. Until that is done, disable or block the component's frontend uploader (the unauthenticated getContent task that reaches site/uploader.php) and restrict execution of uploaded files under the Joomla web root. Review that upload directory for unexpected .php files, including image/PHP polyglots, and treat any hits as a possible compromise.