Vulnerabilities

Joomla CMS's default upload filter omitted SHTML files from its list of dangerous file types, allowing users with upload privileges (typically administrator-level, per the privileged-requirement metric in the CVSS 4.0 vector) to place .shtml files on the server. On web servers configured to execute SHTML files (e.g., Apache with server-side includes enabled), an uploaded .shtml file is executed when accessed, giving the attacker server-side code execution on the host. The high subsequent-system impact ratings in the CVSS 4.0 score indicate the compromise can extend beyond the web application itself depending on server configuration. Affected versions span essentially Joomla's entire history: 1.0.0 through 5.4.7 and 6.0.0 through 6.1.2, so virtually every current Joomla installation is in scope, though only hosts that actually execute .shtml are exposed to code execution. No public proof-of-concept or in-the-wild exploitation is known; EPSS currently estimates a 0.4% probability of exploitation within 30 days (29th percentile) and the flaw is not on the CISA KEV list.

Do: Upgrade all Joomla sites to the first patched release after 5.4.7 (5.x line) and after 6.1.2 (6.x line) once available. Until then, restrict upload capability to trusted administrators and review media/upload directories for unexpected .shtml files. Also confirm whether your web server executes .shtml files (e.g., Apache with server-side includes enabled), since hosts that only store but never execute them carry little code-execution risk.

Joomla Extension - rsjoomla.com - Unauthenticated file upload in RSFiles component < 1.17.12 - The Joomla extension RSFiles is vulnerable to an unauthenticated arbitrary file upload that allows uploading executable files and leads to full RCE.

An improper access check allows unauthorized users to create custom fields via webservices endpoints.

Joomlack Page Builder, a page-builder extension for the Joomla CMS from the Joomlack vendor, contains an improper access control flaw (CWE-284) that permits unauthenticated arbitrary file upload to affected sites. An unauthenticated remote attacker can abuse the upload functionality to place attacker-controlled files, typically executable script files, on the web server and then request them to achieve remote code execution. Successful exploitation yields code execution under the web server's privileges, enabling full compromise of the website and potentially the underlying hosting account or server; ransomware use has not been confirmed. Any Joomla deployment with the affected extension installed is potentially exposed, with internet-facing sites at greatest risk, and CISA has not published specific affected version ranges. The flaw was added to the CISA KEV catalog on 2026-07-07, indicating confirmed in-the-wild exploitation, and it carries a high exploitation likelihood (EPSS 30.4%, 98th percentile), although no public proof-of-concept or detailed technical write-up is known.

Do: Inventory Joomla sites for the Joomlack Page Builder extension and apply the vendor's fix as soon as it is released, following the CISA required action and BOD 26-04 guidance; if mitigations are unavailable, remove, disable, or restrict the extension - particularly on internet-exposed or cloud-hosted instances - or discontinue use per BOD 26-04. Until patched, review upload directories for unexpected executable files (e.g., potential webshells) and check access logs for unauthenticated upload requests, and limit direct web access to upload paths where feasible.

The K2 frontend article-save handler accepts an `attachment[N][existing]` POST field that is concatenated with `JPATH_SITE/` and passed to `JFile::copy()`. `JPath::clean` does NOT strip `..`, and there is no allow-list of source paths. An Author can therefore copy `configuration.php` (or any other file readable by the web user — including `../../../etc/passwd`) into `/media/k2/attachments/`, then retrieve the contents via the K2 attachment-download endpoint.

Joomla! Component Extra Search 2.2.8 contains an SQL injection vulnerability that allows unauthenticated attackers to manipulate database queries by injecting SQL code through the establename parameter. Attackers can send GET requests to index.php with the option=com_extrasearch parameter and malicious SQL in the establename field to extract sensitive database information.

Joomla! Component Calendar Planner 1.0.1 contains an SQL injection vulnerability that allows unauthenticated attackers to inject SQL commands through the category_id parameter. Attackers can send GET requests to the events view with malicious SQL code in the category_id parameter to extract sensitive database information.

Joomla OSDownloads 1.7.4 contains an SQL injection vulnerability that allows unauthenticated attackers to execute arbitrary SQL queries by injecting malicious code through the id parameter. Attackers can send GET requests to index.php with option=com_osdownloads&view=item&id=[SQL] to extract sensitive database information including credentials and configuration data.

The password and username reset features created plain http links for https connections if the "Force SSL" flag wasn't explicitly set.