Unauthenticated File Upload RCE in DJ-Classifieds Joomla Extension

Executive Summary

CVE-2026-61424 is an unauthenticated arbitrary file upload vulnerability in the DJ-Classifieds Joomla extension. It allows attackers to upload malicious files without authentication or a CSRF token by exploiting the front-end task option=com_djclassifieds&task=imageupload. The vulnerability bypasses basic controls like file extension checks and a weak content scan that only looks for specific strings like <?php or eval(.

Useful 0 Not Useful 0

Detection Guidance

Check server logs for anonymous requests to the vulnerable endpoint: option=com_djclassifieds&task=imageupload. Look for uploaded files in the default upload directory tmp/djupload, especially randomly named .gif files containing PHP code. Inspect for unauthorized administrator accounts or modified PHP files.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can lead to remote code execution (RCE) if the server is misconfigured. Attackers can upload malicious PHP code hidden in image files, creating a web shell. This may result in full server compromise, data theft, or further attacks. Even if the server does not execute the PHP directly, the uploaded file could be used for lateral movement or exploitation of other vulnerabilities.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file uploads and remote code execution, potentially exposing sensitive data. For GDPR, this may result in unauthorized access to personal data, triggering breach notification requirements. For HIPAA, it could compromise protected health information if the system handles such data. Both standards require strict access controls and audit logging, which this flaw bypasses.

Useful 0 Not Useful 0

Mitigation Strategies

Update DJ-Classifieds to version 3.11.2 or later immediately. If updating is not possible, block access to the vulnerable endpoint via firewall or WAF. Remove any suspicious files from tmp/djupload and audit the system for signs of compromise.

Useful 0 Not Useful 0