Description
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Affected products
Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.
icagenda.com iCagenda extension for Joomla
Default version status: unaffected
3.2.1-4.0.7affected
References
- https://www.icagenda.com/ ↗
- https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/ ↗
- https://www.icagenda.com/docs/changelog/icagenda-3-9-15 ↗
- https://www.icagenda.com/docs/changelog/icagenda-4-0-8 ↗
- https://github.com/Polosss/By-Poloss..-..CVE-2026-48939 ↗
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939 ↗