CVE-2026-100747
Received Received - Intake

CSRF in Event Gallery Joomla Extension

Publication date: 2026-09-27

Last updated on: 2026-09-27

Assigner: Joomla! Project

Description
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-27
Last Modified
2026-09-27
Generated
2026-09-27
AI Q&A
2026-09-27
EPSS Evaluated
N/A
NVD
CVE-2026-100747
EUVD
EUVD-2026-87930

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
bitnlight event_gallery to 6.5.0 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-352 The web application does not, or cannot, sufficiently verify whether a request was intentionally provided by the user who sent the request, which could have originated from an unauthorized actor.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) issue in the Event Gallery Joomla extension versions before 6.5.0. It allows an attacker to upload files to an event without proper authorization by exploiting the lack of CSRF token checks. This can lead to overwriting existing files with the same name.

Detection Guidance

To detect this CSRF vulnerability in the Event Gallery Joomla extension, monitor for unauthorized file uploads to event directories. Check server logs for POST requests to /administrator/components/com_eventgallery/upload.php without valid CSRF tokens. Review file timestamps and compare against known legitimate uploads.

Impact Analysis

An attacker could exploit this to upload malicious files or overwrite important files in your Joomla event gallery. This may disrupt your website's functionality, corrupt data, or allow further attacks if the uploaded files are harmful.

Compliance Impact

This vulnerability could lead to unauthorized file uploads, potentially exposing sensitive data or violating data integrity. For GDPR, it may risk unauthorized access to personal data. For HIPAA, it could compromise protected health information if medical images are involved.

Mitigation Strategies

Update the Event Gallery extension to version 6.5.0 or higher to address the CSRF vulnerability in image uploads.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-100747. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart