Executive brief
iCagenda, a popular event management extension for Joomla websites, contains a critical security flaw in its file attachment feature. This vulnerability allows an attacker to upload malicious files to the web server without needing a password. If exploited, an attacker can take full control of the website, potentially stealing sensitive data or disrupting operations.
Technical details
An unrestricted file upload vulnerability (CWE-434) exists in the iCagenda extension for Joomla within the file attachment functionality. The application fails to properly validate file extensions or content types, allowing unauthenticated remote attackers to upload arbitrary files, including PHP scripts. By accessing the uploaded malicious file, an attacker can achieve remote code execution (RCE) with the privileges of the web server. This vulnerability has been observed being exploited in the wild. Patches are available in versions 3.9.15 and 4.0.8.
Affected products
- Joomlic iCagenda 3.2.1 to 3.9.14, 4.0.0 to 4.0.7
Timeline
- 2026-06-22: advisory: Initial vulnerability details emerged
- 2026-06-30: other: Initial analysis by NIST/NVD published
- 2026-07-10: kev added: Added to CISA Known Exploited Vulnerabilities catalog
- 2026-07-10: disclosed: Final CVE record modification and publication