Executive brief
Phoca Download is a popular file management extension for Joomla websites that allows administrators to organize and serve downloadable content. A security vulnerability in versions up to 6.1.2 allows registered users to bypass file-type restrictions and upload malicious executable files, such as PHP scripts, if the user-upload feature is enabled. If exploited, an attacker could gain full control over the web server, potentially leading to data theft, site defacement, or service disruption.
Technical details
A vulnerability exists in the frontend member-upload feature of Phoca Download due to an unrestricted file upload flaw (CWE-434). The extension failed to apply the administrator-configured file-type allow-list to member uploads because of an internal upload-mode mismatch; the validation check was only implemented for a different upload mode. An authenticated attacker with a registered account can upload a .php file to the public user-upload folder and execute it by requesting the file via a browser. This vulnerability requires the 'Enable User Upload' feature to be active and a category to grant upload rights to registered users. The issue is resolved in version 6.1.3.
Affected products
- Phoca.cz Phoca Download extension for Joomla 1.0 - 6.1.2
Timeline
- 2026-07-10: patched: Fixed in version 6.1.3
- 2026-07-11: advisory: Public disclosure and CVE assignment