# CVE-2026-102787: Phoca Download CSRF in category management

Source: https://junglewise.ai/threats/cve-2026-102787-joomla-extension-phoca-cz-csrf-in-category-management-in-phoca  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-10-27. Updated: 2026-10-27  
License: CC BY 4.0 with a link back

CVE-2026-102787 · Severity: info · Published 2026-10-27

Phoca Download is a Joomla extension for managing and downloading files. A Cross-Site Request Forgery (CSRF) vulnerability in the category management feature could allow attackers to perform unauthorized actions on behalf of logged-in administrators, such as modifying download categories without their knowledge or consent.

Technologies: [Phoca.cz Phoca Download](https://junglewise.ai/threats/technologies/phoca-download). Vendors: [Phoca.cz](https://junglewise.ai/threats/vendors/phoca-cz).

## Quick answers

**Is CVE-2026-102787 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-102787 being exploited in the wild.

**How severe is CVE-2026-102787?** Informational severity, published 27 October 2026.

**Which products and versions are affected?** Phoca.cz Phoca Download 3.1.0 to 6.1.5.

**Is there a fix for CVE-2026-102787?** Yes: fixed in Phoca Download 6.1.6. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-102787 attacked?** It is attacked over the network, in a web application.

**Am I affected by CVE-2026-102787?** Check whether you run Phoca.cz Phoca Download at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in Phoca Download 6.1.6

## Technical details

The vulnerability is a CSRF flaw in the category management functionality of Phoca Download, affecting versions 3.1.0 through 6.1.5. An attacker can craft a malicious request that, when visited by an authenticated administrator, executes unintended changes to download categories. The attack requires the administrator to be actively logged into the Joomla backend. A fix is available in version 6.1.6, released as a security update.

## Affected products

- phoca.cz Phoca Download 3.1.0 to 6.1.5

## Timeline

- 2026-10-27: disclosed
- 2026-10-26: patched: Version 6.1.6 released as security release

## References

- [https://www.phoca.cz/](https://www.phoca.cz/)

## Related threats

- [Phoca Download reflected XSS in search parameter](https://junglewise.ai/threats/cve-2026-76569-phoca-download-reflected-xss-in-search-parameter)
- [Phoca Download for Joomla unrestricted file upload in member-upload feature](https://junglewise.ai/threats/cve-2026-57828-phoca-download-for-joomla-unrestricted-file-upload-in-member)