Loading story…
A zero-day vulnerability in the Joomla extension iCagenda allowed attackers to upload arbitrary files and achieve remote code execution (RCE), and the issue was addressed in version 4.0.8. The flaw fit the well-known pattern of unrestricted file upload, where weak validation of uploaded content lets an attacker place executable or otherwise dangerous files on a target server.
OWASP guidance on unrestricted file upload shows how such weaknesses can be exploited through manipulated filenames, extensions, content types, parser behavior, and downstream file processing, leading to outcomes including server compromise, denial of service, phishing, malware hosting, defacement, and information disclosure. Recommended mitigations include strict allow lists, randomized filenames, storing uploads outside executable paths, enforcing size and authorization controls, scanning uploads, and applying secure response headers to reduce the risk of similar upload-to-RCE attacks.
Mallory correlates global threat intelligence with your attack surface — know if you’re exposed before adversaries strike.
2 events from the most recent confirmed update back to the earliest known activity.
CISA added CVE-2026-48939, an unauthenticated file upload RCE in the Joomla iCagenda extension, to its Known Exploited Vulnerabilities catalog. The listing reflected active exploitation and triggered federal remediation requirements under BOD 22-01.
A mySites.guru post reports that a zero-day unrestricted file upload vulnerability leading to remote code execution in iCagenda was fixed in version 4.0.8. The reference does not provide a specific event date beyond the publication context.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
6 references tracked. Mallory keeps watching after this page renders.
github.com
Open sourcethreataft.com
Open sourcecvereports.com
Open sourcejoomlic.com
Open sourceowasp.org
Open sourcemysites.guru
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
CISA has added two Joomla extension vulnerabilities to its Known Exploited Vulnerabilities catalog after confirming active exploitation against **SP Page Builder** and **Page Builder CK**. The flaws, tracked as `CVE-2026-48908` and `CVE-2026-56290`, are unauthenticated arbitrary file upload bugs that allow attackers to place malicious files on exposed Joomla sites and achieve remote code execution. Security reporting says the vulnerabilities have been used to upload web shells, deploy PHP file-manager backdoors, and create hidden administrator accounts for persistence on compromised systems. Vendor fixes are available, including **SP Page Builder 6.6.2** for the zero-day issue, and defenders are being urged to patch immediately or temporarily disable the affected extensions and restrict public access to vulnerable upload endpoints until remediation is complete.
Jul 8, 2026
A critical vulnerability, **`CVE-2026-56290`**, affects the Joomla **Page Builder CK** extension before version **3.6.0** and allows **unauthenticated arbitrary file upload**. The flaw can let remote attackers upload executable files and achieve **full remote code execution**, and it has been assigned a **CVSS 4.0 score of 10.0**. Belgium’s Centre for Cybersecurity issued a warning urging organizations to patch immediately because exposed Joomla sites using the vulnerable extension could be compromised without authentication. Advisories recommend upgrading **Page Builder CK** to **3.6.0 or later**, restricting upload permissions, and validating allowed file types to reduce exposure. Related vulnerability reporting published at the same time also highlighted a separate critical web CMS plugin issue, **`CVE-2026-57331`**, in the WordPress **Paid Videochat Turnkey Site** plugin through **7.4.8**, where an **arbitrary file deletion** flaw rated **CVSS 9.9** was remediated in **7.4.9** or later, underscoring continued risk from insecure file-handling bugs in widely deployed content management extensions.
Jul 1, 2026
CISA added two Joomla extension vulnerabilities to its **Known Exploited Vulnerabilities (KEV)** catalog after reports of active zero-day abuse against public-facing sites. The flaws, **`CVE-2026-48939`** in **iCagenda** and **`CVE-2026-56291`** in **Balbooa Forms**, are unrestricted file upload bugs that let attackers upload executable PHP files and gain **remote code execution**; the iCagenda issue carries a **CVSS 10.0** rating. Under **Binding Operational Directive 22-01**, Federal Civilian Executive Branch agencies were ordered to remediate both issues by **July 13, 2026**. Reporting cited by CISA said automated exploitation of the iCagenda flaw began on **June 15**, while the Balbooa Forms bug was identified during a live customer attack on **July 8**. Vendors have released fixes, with **JoomliC** patching iCagenda in versions **4.0.8** and **3.9.15**, and **Balbooa Forms** addressing its vulnerability in version **2.4.1**. The warning comes amid broader alerts, including from Australia’s **ACSC**, about global campaigns targeting CMS platforms and plugins to plant web shells, and CISA urged organizations beyond the federal government to review the KEV catalog and remediate affected systems.
Jul 14, 2026