Loading vulnerability…
Unauthenticated file upload RCE in Joomla iCagenda
CVE-2026-48939 is an unrestricted file upload vulnerability in the iCagenda event-management extension for Joomla. The file attachment feature in the Submit Event form fails to enforce file-type validation, allowing attackers to upload executable PHP files and invoke them over HTTP to achieve remote code execution. Affected releases include iCagenda 4.x through 4.0.7 and legacy 3.x versions 3.2.1 through 3.9.14. Exploitation is generally unauthenticated, although some configurations may require low privileges. Exploitation in the wild has been reported since June 15, 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
Successful exploitation enables arbitrary PHP execution and can lead to complete compromise of the affected Joomla website and web server. Potential consequences include theft of site data, website defacement, web shell installation, unauthorized administrator account creation, and use of the compromised server for further attacks. The extent of access to other systems depends on the compromised environment.
If you can’t patch tonight, do this now.
If immediate patching is not possible, disable the vulnerable component or its file upload functionality, restrict accepted file types, and limit public access to the affected workflow. Joomla 6 default PHP upload restrictions may offer some protection, but they should not be relied upon: upload and PHP execution were reproduced with Joomla 6 and iCagenda 4.0.7.
Patch, then assume compromise.
Upgrade iCagenda to version 4.0.8 or later on the 4.x branch, or version 3.9.15 on the legacy 3.x branch. Updating Joomla core alone does not fix the extension vulnerability. Investigate previously exposed installations for malicious uploaded scripts, web shells, unauthorized administrator accounts, modified application files, and suspicious web server activity. Patching does not remove existing attacker access; confirmed compromises require removal of persistence, credential rotation, and restoration from known-clean backups where necessary.
3 exploits validated by Mallory's analysis. Hidden: 1 rejected by Mallory's analysis as not a working exploit.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
74 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.