Executive brief
Events Booking is a popular Joomla extension used to manage event registrations and payments. A security flaw in versions prior to 5.8.0 allowed an attacker to trick a logged-in user into performing unintended file uploads because the system did not verify that the upload request was intentional. This could potentially lead to unauthorized files being placed on the server if a user is lured to a malicious website while logged into their Joomla site.
Technical details
A Cross-Site Request Forgery (CSRF) vulnerability exists in the frontend file upload endpoint of the Events Booking extension for Joomla in versions prior to 5.8.0. The affected component fails to implement or validate anti-CSRF tokens (synchronizer tokens) during file upload operations. An attacker can exploit this by crafting a malicious webpage that triggers a POST request to the file upload endpoint; if a site user with appropriate permissions visits this page while authenticated, the browser will automatically include their session cookies, executing the upload. This could lead to unauthorized file storage on the server. The issue is resolved in version 5.8.0.
Affected products
- joomdonation.com Events Booking extension for Joomla 1.0 through 5.7.9
Timeline
- 2026-07-15: patched: Version 5.8.0 released to address the issue.
- 2026-07-17: disclosed: CVE-2026-60025 published.