Unauthenticated File Upload RCE in JDownloads Joomla Extension

Executive Summary

CVE-2026-61900 is a vulnerability in the jDownloads Joomla extension affecting versions 4.1.0 to 4.1.5. It involves an unauthenticated file upload flaw due to a leftover test script, upload-handler.php, which allows anonymous users to upload files without authentication or permission checks. The script enforces a hardcoded allow-list that excludes PHP files but permits other dangerous file types like archives, images, and executables.

Useful 0 Not Useful 0

Detection Guidance

Check for the presence of the vulnerable file upload-handler.php in the path administrator/components/com_jdownloads/assets/upload/. Use commands like: find /path/to/joomla -name 'upload-handler.php' to locate it.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can allow attackers to upload malicious files such as malware or phishing pages to your server. This may lead to reputational damage, disk space exhaustion, or in misconfigured servers, remote code execution (RCE). The impact depends on server configurations and whether executable file uploads are allowed.

Useful 0 Not Useful 0

Compliance Impact

This vulnerability could lead to unauthorized file uploads, potentially exposing sensitive data. GDPR requires protecting personal data, and HIPAA mandates safeguarding health information. A breach via this flaw may result in non-compliance, legal penalties, or reputational damage due to unauthorized access or data leaks.

Useful 0 Not Useful 0

Mitigation Strategies

Update jDownloads to version 4.1.6 or later. As a temporary fix, manually delete the file upload-handler.php from the specified path. Ensure Joomla's upload blacklist is properly configured.

Useful 0 Not Useful 0