Executive brief
Events Booking is a popular Joomla extension used to manage event registrations and payments. In versions prior to 5.8.0, the software was configured by default to allow any website visitor to upload media files without logging in. This could lead to unauthorized storage usage or the hosting of inappropriate content on the organization's web server.
Technical details
The Events Booking extension for Joomla (versions prior to 5.8.0) suffers from an insecure default initialization of resources (CWE-1188). By default, the extension's configuration permitted unauthenticated (guest) users to perform media asset uploads. An attacker can exploit this by sending unauthenticated requests to the upload component, potentially leading to resource exhaustion or the hosting of arbitrary media files. The issue was addressed in version 5.8.0 by hardening the default permissions for media uploads.
Affected products
- joomdonation.com Events Booking extension for Joomla 1.0 through 5.7.9
Timeline
- 2026-07-15: patched: Version 5.8.0 released
- 2026-07-17: disclosed: CVE-2026-60024 published by Joomla Project