Is CVE-2026-57828 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-57828 being exploited in the wild.

How severe is CVE-2026-57828?

Informational severity, with a CVSS score of 9, published 11 July 2026.

Which products and versions are affected?

Phoca.cz Phoca Download 1.0 - 6.1.2.

Is there a fix for CVE-2026-57828?

A patch was published on 2026-07-10: Fixed in version 6.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-57828 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-57828?

Check whether you run Phoca.cz Phoca Download at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-57828: Phoca Download for Joomla unrestricted file upload in member-upload feature

CVE-2026-57828 · Severity: info · CVSS 9 · Published 2026-07-11

Phoca Download is a popular file management extension for Joomla websites that allows administrators to organize and serve downloadable content. A security vulnerability in versions up to 6.1.2 allows registered users to bypass file-type restrictions and upload malicious executable files, such as PHP scripts, if the user-upload feature is enabled. If exploited, an attacker could gain full control over the web server, potentially leading to data theft, site defacement, or service disruption.

Technologies: Phoca.cz Phoca Download. Vendors: Phoca.cz.

Quick answers

Is CVE-2026-57828 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-57828 being exploited in the wild.
How severe is CVE-2026-57828?: Informational severity, with a CVSS score of 9, published 11 July 2026.
Which products and versions are affected?: Phoca.cz Phoca Download 1.0 - 6.1.2.
Is there a fix for CVE-2026-57828?: A patch was published on 2026-07-10: Fixed in version 6.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-57828 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-57828?: Check whether you run Phoca.cz Phoca Download at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

Technical details

A vulnerability exists in the frontend member-upload feature of Phoca Download due to an unrestricted file upload flaw (CWE-434). The extension failed to apply the administrator-configured file-type allow-list to member uploads because of an internal upload-mode mismatch; the validation check was only implemented for a different upload mode. An authenticated attacker with a registered account can upload a .php file to the public user-upload folder and execute it by requesting the file via a browser. This vulnerability requires the 'Enable User Upload' feature to be active and a category to grant upload rights to registered users. The issue is resolved in version 6.1.3.

Affected products

Phoca.cz Phoca Download extension for Joomla 1.0 - 6.1.2

Timeline

2026-07-10: patched: Fixed in version 6.1.3
2026-07-11: advisory: Public disclosure and CVE assignment

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.