Loading vulnerability…
CVE-2026-48939 is a critical unrestricted file upload vulnerability in the iCagenda extension for Joomla. The flaw affects the extension's file attachment functionality, including the Submit Event workflow, where insufficient validation allows an unauthenticated attacker to upload arbitrary files with dangerous types. In vulnerable deployments, this permits upload of server-executable PHP content into a web-accessible location, after which the attacker can invoke the uploaded script to achieve remote code execution. Reported affected versions include iCagenda 4.x through 4.0.7 and legacy 3.x from 3.2.1 through 3.9.14.
Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.
What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
If you can’t patch tonight, do this now.
Patch, then assume compromise.
3 valid exploits after Mallory filtered fakes, detection scripts, and README-only repos (1 hidden).
This six-file Python/PHP repository is an operational Joomla exploitation suite. CVE-2026-Joomla-Suite.py is the command-line entry point: it accepts one target or a target list, can fingerprint installed extensions, supports concurrent scanning, optional proxying and JSON output, and invokes the modules in joomla_exploits.py. It loads payloads/x7-panel.php and attempts the listed extension-specific CVE modules in sequence or a module selected with --cve. Successful deployments are logged locally in panels_joomla.txt and scan_joomla_live.log. The suite claims seven unauthenticated extension paths and includes an additional credential-dependent CVE-2026-73373/com_media path in code. The PHP payload is a functional web shell rather than a benign proof-of-concept: it exposes unauthenticated command execution, filesystem reconnaissance, and arbitrary file-writing/upload features. The only Python dependency is requests; winrarzips_brand.py provides presentation/banner code. CVE and affected-version claims are repository assertions; only the SP LMS Joomla <5.2.2 condition is explicitly stated in the supplied content.
This repository contains a single Python exploit script, iCagenda_rce.py, implementing a mass exploitation workflow for an alleged unauthenticated file-upload-to-RCE issue in the Joomla iCagenda extension, identified in the script as CVE-2026-48939. The script is not a framework module; it is a standalone threaded scanner/exploiter. Structure and behavior: the script first normalizes targets from a user-supplied file, deduplicates them, and processes them concurrently with up to 120 threads. For each target, it attempts product detection by requesting /administrator/components/com_icagenda/icagenda.xml and, if available, parsing the <version> tag. If that fails, it performs heuristic detection using HEAD requests to /components/com_icagenda/icagenda.php and /media/com_icagenda/css/icagenda.css. It then applies built-in version gating logic, treating versions below 3.9.15 and 4.0.0 through 4.0.7 as vulnerable. Exploit capability: after detection, the script sends multipart POST requests to Joomla com_icagenda submission endpoints using several candidate task names and upload field names. The uploaded payload is a PHP webshell that prints php_uname() and exposes another upload form, enabling post-compromise file upload. After upload, the script probes several likely storage paths to find the deployed shell and confirms success by checking for a unique marker string in the response body. Successful shell URLs are written to shells.txt. Notable operational details: the exploit tries both HTTPS and HTTP, disables TLS verification, uses a browser-like User-Agent, and performs broad path guessing for uploaded file placement. The code is clearly offensive and intended for bulk exploitation rather than mere detection. The payload is hardcoded and basic, so the maturity is best classified as OPERATIONAL rather than WEAPONIZED.
This repository is a standalone Python proof-of-concept/operational exploit for CVE-2026-48939, targeting the iCagenda Joomla extension. The repo is small and focused: a single Python exploit script (cve_2026_48939.py), a README with usage and vulnerability details, a requirements file, and a .gitignore. The exploit is not part of a larger framework. Core capability: the script performs unauthenticated remote code execution by abusing an arbitrary file upload flaw in iCagenda’s frontend registration submission flow. It first detects whether a target likely runs iCagenda by requesting /administrator/components/com_icagenda/icagenda.xml and extracting a <version> value when available; if that fails, it probes several iCagenda-specific paths with HEAD requests. It then evaluates version ranges with built-in logic that marks 3.2.1–3.9.14 and 4.0.0–4.0.7 as vulnerable, but still attempts exploitation when version detection is inconclusive. Exploitation logic: the script iterates over HTTP and HTTPS, tries multiple task names (registration.submit and submit), and cycles through several possible multipart field names for the uploaded file. It generates a randomized PHP filename and embeds a randomized token into a hardcoded PHP webshell. The shell supports three actions via GET parameters: token validation (t), command execution (c), and self-delete (d). The exploit expects the uploaded file to land in one of several candidate directories, primarily /images/icagenda/frontend/attachments/, then attempts to access the shell over the web and run a command to confirm RCE. Cleanup is optional; by default it appears designed to remove the shell after successful use unless --no-cleanup is specified. Operational features: the script supports single-target and mass-target modes, concurrent execution with a thread pool, output saving, randomized User-Agent headers, disabled TLS verification, and verbose logging. This makes it more than a minimal PoC but still a straightforward standalone exploit with a basic hardcoded payload rather than a customizable framework-integrated module. Notable fingerprintable targets and paths include the Joomla/iCagenda manifest and marker files, the vulnerable controller endpoint /index.php?option=com_icagenda&task=registration.submit, and the expected upload directory /images/icagenda/frontend/attachments/. Overall, the repository’s purpose is to automate detection, exploitation, command execution, and optional cleanup for unauthenticated file-upload-to-RCE against vulnerable iCagenda installations.
Products and vendors Mallory has correlated with this vulnerability. Open in Mallory to drill down to specific CPE configurations and version ranges.
Vendor-confirmed product mapping. Mallory continuously reconciles this list against your asset inventory.
73 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.
An iCagenda vulnerability listed among vulnerabilities actively exploited or operationally weaponized in July 2026.
A pre-authentication arbitrary file upload vulnerability leading to remote code execution in the iCagenda Joomla extension.
An unauthenticated arbitrary file upload vulnerability in the iCagenda Joomla component that allows file upload and PHP execution on vulnerable versions.
A critical unauthenticated arbitrary file upload vulnerability in the iCagenda extension for Joomla that enables attackers to upload executable PHP files via the Submit Event form and achieve remote code execution.
Query your assets running an affected version, and investigate the blast radius.
Every observed campaign linking this CVE to a named adversary.
Malware families riding this exploit, with evidence and IOCs.
YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.
Cross-references every affected SKU, including bundled OEM variants.
Community discussion across Reddit, Mastodon, and other social sources.