CVE-2026-84048

Received Received - Intake

Unauthenticated File Upload in JoomGallery Extension

Publication date: 2026-09-15

Last updated on: 2026-09-19

Assigner: Joomla! Project

Description

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published

2026-09-15

Last Modified

2026-09-19

Generated

2026-10-06

AI Q&A

2026-09-16

EPSS Evaluated

2026-10-04

NVD

CVE-2026-84048

EUVD

EUVD-2026-79182

Affected Vendors & Products

Vendor	Product	Version / Range
joomgalleryfriends	joomgallery	to 4.4.1 (exc)

Helpful Resources

Exploitability

CWE

KEV

CWE ID	Description
CWE-284	The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor.

Attack-Flow Graph

Executive Summary

This vulnerability is an unauthenticated arbitrary file upload flaw in JoomGallery versions before 4.4.1. It exists in the TUS endpoint, which allows attackers to upload files without authentication. However, attackers cannot control the file name or extension. Code execution is only possible with non-standard server configurations.

Detection Guidance

To detect this vulnerability, check if JoomGallery versions prior to 4.4.1 are installed. Inspect server logs for unusual file uploads to the TUS endpoint. Verify if arbitrary files were uploaded without proper authentication.

Impact Analysis

An attacker could exploit this to upload malicious files to your server, potentially leading to remote code execution if server configurations are non-standard. This could allow unauthorized access, data theft, or further compromise of your Joomla site.

Compliance Impact

This vulnerability could lead to unauthorized data access or exfiltration, violating GDPR's data protection requirements or HIPAA's safeguards for protected health information. Non-compliance may result in legal penalties, fines, or reputational damage.

Mitigation Strategies

Immediately upgrade JoomGallery to version 4.4.1 or later to patch the unauthenticated arbitrary file upload vulnerability via the TUS endpoint. Ensure your Joomla installation is updated to a supported version (5 or 6) with PHP 8.0.x or higher.

Hi! I’m here to help you understand CVE-2026-84048. Ask me anything about the vulnerability, its impact, or mitigation strategies.

0/70