CVE-2026-57828CWE-434unrestricted-file-upload

CVE-2026-57828

High · published July 11, 2026

CVSS v3.1
8.8
EPSS
1%
Percentile
44.8
In the wild
Unconfirmed
What it is

Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.00543 · 44.8th percentile
Weakness
CWE-434 · Unrestricted Upload of File with Dangerous Type
Published
2026-07-11T14:16Z
Affected products (1)
ProductVersionsFixed in
phoca/download< 6.1.36.1.3
References (2)
https://mysites.guru/blog/phoca-download-authenticated-file-upload-rce/ · [email protected]https://www.phoca.cz/phocadownload · [email protected]
EPSS history
Timeline
  • 11 JUL 09:27Z
    Joomla Extension - phoca.cz - Authenticated file upload in RSFiles component < 6.1.3
    cvelistv5