CVE-2026-88856
Received Received - Intake

Authenticated RCE in OrdaSoft Joomla Gallery Extension

Publication date: 2026-09-20

Last updated on: 2026-09-20

Assigner: Joomla! Project

Description
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions updateOSGallery(), reached via task=update_osgallery, read a JSON request body and called the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check of any kind. Any function name compatible with a single argument was directly reachable, including system, exec, shell_exec, and passthru.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-20
Last Modified
2026-09-20
Generated
2026-09-21
AI Q&A
2026-09-20
EPSS Evaluated
N/A
NVD
CVE-2026-88856
EUVD
EUVD-2026-83765

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
ordasoft joomla_gallery_extension to 6.2.7 (exc)

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-94 The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This is an authenticated, privileged remote code execution vulnerability in the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7. The flaw exists in the updateOSGallery() function, which is accessible via the task=update_osgallery parameter. The function reads a JSON request body and uses the value of a method field as a live PHP function name without any validation or allow-list checks. This allows attackers to execute arbitrary PHP functions like system, exec, or shell_exec by passing malicious input in the package field.

Detection Guidance

Check for the presence of the vulnerable OrdaSoft Joomla Gallery extension version below 6.2.7. Inspect Joomla admin logs for suspicious task=update_osgallery requests or unexpected PHP function calls like system, exec, or shell_exec in request bodies.

Impact Analysis

If you are running an affected Joomla Gallery extension version, an authenticated attacker with privileged access could execute arbitrary commands on your server. This could lead to full system compromise, data theft, or unauthorized modifications. The attacker needs valid credentials but could leverage this to escalate privileges or move laterally within a network.

Compliance Impact

This vulnerability could lead to unauthorized access and data breaches, violating GDPR and HIPAA requirements for data protection and access controls. Organizations may face fines, legal penalties, and reputational damage if exploited. Compliance programs must address this risk through patching and access controls.

Mitigation Strategies

Immediately update the OrdaSoft Joomla Gallery extension to version 6.2.7 or later. Remove or disable the extension if no update is available. Review and restrict admin access to Joomla backends to minimize exposure.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-88856. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart