# CVE-2026-57828: Phoca Download for Joomla unrestricted file upload in member-upload feature

Source: https://junglewise.ai/threats/cve-2026-57828-phoca-download-for-joomla-unrestricted-file-upload-in-member  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-11. Updated: 2026-07-11  
License: CC BY 4.0 with a link back

CVE-2026-57828 · Severity: info · CVSS 9 · Published 2026-07-11

Phoca Download is a popular file management extension for Joomla websites that allows administrators to organize and serve downloadable content. A security vulnerability in versions up to 6.1.2 allows registered users to bypass file-type restrictions and upload malicious executable files, such as PHP scripts, if the user-upload feature is enabled. If exploited, an attacker could gain full control over the web server, potentially leading to data theft, site defacement, or service disruption.

Technologies: [Phoca.cz Phoca Download](https://junglewise.ai/threats/technologies/phoca-download). Vendors: [Phoca.cz](https://junglewise.ai/threats/vendors/phoca-cz).

## Quick answers

**Is CVE-2026-57828 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-57828 being exploited in the wild.

**How severe is CVE-2026-57828?** Informational severity, with a CVSS score of 9, published 11 July 2026.

**Which products and versions are affected?** Phoca.cz Phoca Download 1.0 - 6.1.2.

**Is there a fix for CVE-2026-57828?** A patch was published on 2026-07-10: Fixed in version 6.1.3 Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-57828 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-57828?** Check whether you run Phoca.cz Phoca Download at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A vulnerability exists in the frontend member-upload feature of Phoca Download due to an unrestricted file upload flaw (CWE-434). The extension failed to apply the administrator-configured file-type allow-list to member uploads because of an internal upload-mode mismatch; the validation check was only implemented for a different upload mode. An authenticated attacker with a registered account can upload a .php file to the public user-upload folder and execute it by requesting the file via a browser. This vulnerability requires the 'Enable User Upload' feature to be active and a category to grant upload rights to registered users. The issue is resolved in version 6.1.3.

## Affected products

- Phoca.cz Phoca Download extension for Joomla 1.0 - 6.1.2

## Timeline

- 2026-07-10: patched: Fixed in version 6.1.3
- 2026-07-11: advisory: Public disclosure and CVE assignment

## References

- [https://mysites.guru/blog/phoca-download-authenticated-file-upload-rce/](https://mysites.guru/blog/phoca-download-authenticated-file-upload-rce/)
- [https://www.phoca.cz/phocadownload](https://www.phoca.cz/phocadownload)

## Related threats

- [Phoca Download CSRF in category management](https://junglewise.ai/threats/cve-2026-102787-joomla-extension-phoca-cz-csrf-in-category-management-in-phoca)
- [Phoca Download reflected XSS in search parameter](https://junglewise.ai/threats/cve-2026-76569-phoca-download-reflected-xss-in-search-parameter)