CVE-2026-117551
File-upload RCE in jDownloads before 4.1.8
- CVSS 4.0
- 10.0 critical
- EPSS
- <1%p39
- Published
- ·
- Modified
jDownloads for Joomla does not sufficiently validate frontend thumbnail uploads in versions before 4.1.8. A user who already has upload permission can place executable files on the server over the network, leading to PHP code execution. Sites running the affected extension and granting that upload permission are at risk.
What to do: Upgrade jDownloads to 4.1.8 or later.
| Product | Affected | Fixed in |
|---|---|---|
| jdownloads.com jDownloads | < 4.1.8 | 4.1.8 |
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution.
- Ecosystems
- Joomla
- Weakness
- CWE-434
- Vector
- CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X
In the news
0 storiesNo ingested article mentions this CVE yet.