CriticalPublic exploit

Improper access control in Tassos Framework Joomla plugin com_ajax handling

IdentifiersCVE-2026-21627CWE-284· Improper Access Control

CVE-2026-21627 is an improper access control issue in the Tassos Framework plugin for Joomla. The vulnerability is rooted in how the plugin handled specific AJAX requests delivered through Joomla’s com_ajax entry point. Under certain conditions, these requests could reach and invoke internal framework functionality without proper restriction. Based on the available information, the flaw appears to stem from insufficient access checks or exposure controls around AJAX-accessible internal methods rather than memory corruption or injection.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation can allow unauthorized invocation of internal framework functionality through network-accessible AJAX requests. The provided CVSS v4.0 metadata indicates potentially high impact to confidentiality, integrity, and availability, suggesting that exposed internal functionality could enable significant unintended actions depending on what methods are reachable in the affected deployment. The exact downstream effects are not further specified in the available content.

Mitigation

If you can’t patch tonight, do this now.

Until a patch can be applied, reduce exposure of the vulnerable AJAX path where feasible, disable or restrict the affected Tassos Framework plugin if operationally possible, and limit unauthenticated access to Joomla com_ajax endpoints through application, web server, or WAF controls. Additionally, review which internal framework functions are reachable via AJAX and enforce strict allowlisting and authorization checks.

Remediation

Patch, then assume compromise.

Apply the vendor-provided fix or update for the Tassos Framework plugin addressing CVE-2026-21627. Review the vendor reference at tassos.gr and Joomla-related advisories for the patched version and upgrade guidance. If code-level remediation is required, ensure that AJAX handlers exposed through Joomla com_ajax enforce explicit authorization and restrict access to internal framework functionality.

PUBLIC EXPLOITS

Exploits

1 valid exploit after Mallory filtered fakes, detection scripts, and README-only repos.

VALID 1 / 1 TOTALView more in app

CVE-2026-21627---Tassos-Novarain-Framework-plg_system_nrframework-Exploit---JoomlaMaturityOperationalVerified exploit

Repository contains a single Python exploit script and a README describing CVE-2026-21627 affecting the Joomla plugin Tassos/Novarain Framework (plg_system_nrframework) versions 4.10.14–6.0.37. Structure & entry point: - CVE-2026-21627.py: main exploit driver (argparse CLI) with modes verify|upload|delete|rce|info. - README.md: vulnerability background, usage examples, detection/remediation guidance. Core vulnerability & exploit flow: - Targets Joomla’s com_ajax endpoint for the nrframework plugin (plugin=nrframework) and the non-admin whitelisted task include (task=include), which routes to ajaxTaskInclude(). - The include handler accepts a user-controlled path parameter using RAW filtering (no sanitization), concatenates path+file+.php, and includes it, then instantiates a user-specified class and calls its onAJAX() method. - The exploit chains this file-inclusion primitive to a known gadget class JFormFieldNRInlineFileUpload (nrinlinefileupload.php) located under plugins/system/nrframework/fields/. Capabilities implemented by the script: - Session/CSRF handling: creates a Joomla session by probing the AJAX endpoint, then re-fetches the homepage to extract a session-bound CSRF token (parsed from the csrf.token JS variable). Uses a requests.Session, optional proxy, optional SSL verification disable, and a fixed User-Agent. - verify mode: attempts to confirm the vulnerability (details truncated in provided content, but described as read-only confirmation). - upload mode: uses the gadget’s upload functionality to write attacker-controlled content (base64-encoded in requests per description) into an attacker-chosen directory (default images). Supports different “shell types” (shtml/csv/txt/html) and custom content. - delete mode (destructive): uses the gadget’s remove functionality (unlink without path validation) to delete an arbitrary file path writable by the web server. - rce mode: attempts an execution chain (upload + trigger). README indicates SSI-based execution via .shtml if server supports SSI; otherwise RCE is not guaranteed. - info mode: includes an arbitrary PHP file (relative to JPATH_SITE) and instantiates a specified class for reconnaissance/behavioral probing. Notable targeting details: - Default SEF prefix is /it/ and the exploit builds URLs as: <target><sef_prefix>component/ajax/ . This is a key operational assumption; users must adjust for sites without that prefix. Overall purpose: - An unauthenticated network exploit for CVE-2026-21627 providing practical post-exploitation primitives (file write and file delete) via a gadget chain, plus an optional RCE attempt dependent on server configuration.

yallasecDisclosed Feb 26, 2026pythonmarkdownnetwork (unauthenticated HTTP exploitation of Joomla com_ajax plugin endpoint)

EXPOSURE SURFACE

Affected products & vendors

Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.

VendorProductType

TassosFramework (Tassos Framework) Joomla Pluginapplication

TassosTassos Frameworkapplication

TassosTassos Framework (Joomla Plugin)application

Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.

ACTIVITY FEED

Recent activity

4 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

4 SOURCESView more in app

cvefeed high severityNews

Feb 20, 2026

CVE-2026-21627 - Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 - v6.0.37 for Joomla

An access control/authorization bypass in the Tassos Framework plugin for Joomla involving handling of specific AJAX requests via Joomla’s com_ajax entry point, allowing invocation of internal framework functionality without proper restriction under certain conditions.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity3