CVE-2026-105600
Received Received - Intake

Remote Code Execution in php-web-design.com StageIt Joomla Extension

Publication date: 2026-11-02

Last updated on: 2026-11-02

Assigner: Joomla! Project

Description
Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-11-02
Last Modified
2026-11-02
Generated
2026-11-02
AI Q&A
2026-11-02
EPSS Evaluated
N/A
NVD
CVE-2026-105600

Affected Vendors & Products

Showing 2 associated CPEs
Vendor Product Version / Range
php-web-design.com StageIt extension for Joomla 1.0-5.7.5
php-web-design.com StageIt extension for Joomla 6.0-6.3.5

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Remote Code Execution (RCE) flaw in the StageIt Joomla extension versions 1.0-5.7.5 and 6.0-6.3.5. It allows attackers to execute arbitrary code on the server by manipulating setting strings. The CVSS score of 8.6 indicates high severity due to its potential impact on confidentiality, integrity, and availability.

Impact Analysis

If you use the affected StageIt Joomla extension, an attacker could gain control of your Joomla site, steal sensitive data, modify content, or use the server for malicious activities. The high CVSS score suggests widespread potential impact if exploited.

Compliance Impact

This RCE vulnerability could lead to unauthorized access to personal or sensitive data, violating GDPR and HIPAA requirements. Organizations may face legal penalties, data breach notifications, and reputational damage if exploited.

Mitigation Strategies

Immediately uninstall or disable the StageIt extension versions 1.0-5.7.5 and 6.0-6.3.5 for Joomla. Update to the latest patched version if available. Review server logs for suspicious activity related to remote code execution attempts.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-105600. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart

Security Radar

News mentioning this vulnerability
Loading related security news...