# CVE-2026-117551: Joomla jDownloads file upload RCE in thumbnail handling

Source: https://junglewise.ai/threats/cve-2026-117551-joomla-extension-jdownloads-com-rce-through-file-upload-in  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-11-12. Updated: 2026-11-12  
License: CC BY 4.0 with a link back

CVE-2026-117551 · Severity: info · Published 2026-11-12

jDownloads is a download manager extension for the Joomla content management system. A vulnerability in versions before 4.1.8 allows users with upload permissions to bypass file validation and place executable files (such as PHP scripts) on the server, leading to remote code execution and complete compromise of the Joomla installation.

Technologies: [jDownloads](https://junglewise.ai/threats/technologies/jdownloads). Vendors: [jDownloads](https://junglewise.ai/threats/vendors/jdownloads).

## Quick answers

**Is CVE-2026-117551 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-117551 being exploited in the wild.

**How severe is CVE-2026-117551?** Informational severity, published 12 November 2026.

**Which products and versions are affected?** jDownloads before 4.1.8.

**Is there a fix for CVE-2026-117551?** Yes: fixed in jDownloads 4.1.8. Until then: Disable frontend file uploads in jDownloads settings, restrict upload permissions to trusted administrators only, or implement web server-level restrictions (e.g., .htaccess rules) to prevent execution of scripts in upload directories until the patch can be applied. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-117551 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-117551?** Check whether you run jDownloads at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- Fixed in jDownloads 4.1.8

Disable frontend file uploads in jDownloads settings, restrict upload permissions to trusted administrators only, or implement web server-level restrictions (e.g., .htaccess rules) to prevent execution of scripts in upload directories until the patch can be applied.

## Technical details

The vulnerability exists in the frontend thumbnail upload functionality, which fails to properly validate uploaded files. An authenticated attacker with upload permissions can bypass file type restrictions and upload executable files (e.g., PHP) that are placed directly on the web-accessible server, resulting in arbitrary code execution. The fix in version 4.1.8 addresses insufficient validation of file uploads and image handling.

## Affected products

- jDownloads jDownloads before 4.1.8

## Timeline

- 2026-11-12: disclosed
- 2026-11-12: patched: jDownloads 4.1.8 released

## References

- [https://www.jdownloads.com/](https://www.jdownloads.com/)

## Related threats

- [jDownloads IDOR in other_file_id parameter allows unauthorized file access](https://junglewise.ai/threats/cve-2026-117544-joomla-extension-jdownloads-com-idor-allowing-restricted-file)
- [jDownloads authenticated path traversal via update_file parameter](https://junglewise.ai/threats/cve-2026-117542-joomla-extension-jdownloads-com-authenticated-path-traversal-in)
- [Joomla jDownloads file publication bypass with manipulated submission parameters](https://junglewise.ai/threats/cve-2026-117550-joomla-extension-jdownloads-com-publishing-of-files-without)
- [Joomla jDownloads SSRF via external download URL](https://junglewise.ai/threats/cve-2026-117543-joomla-extension-jdownloads-com-ssrf-via-external-download-url)
- [jDownloads Joomla extension unauthenticated file upload in upload-handler.php](https://junglewise.ai/threats/cve-2026-61900-jdownloads-joomla-extension-unauthenticated-file-upload-in-upload)