# CVE-2026-60025: JoomDonation Events Booking CSRF in frontend file upload

Source: https://junglewise.ai/threats/cve-2026-60025-joomdonation-events-booking-csrf-in-frontend-file-upload  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-17. Updated: 2026-07-17  
License: CC BY 4.0 with a link back

CVE-2026-60025 · Severity: info · CVSS 0 · Published 2026-07-17

Events Booking is a popular Joomla extension used to manage event registrations and payments. A security flaw in versions prior to 5.8.0 allowed an attacker to trick a logged-in user into performing unintended file uploads because the system did not verify that the upload request was intentional. This could potentially lead to unauthorized files being placed on the server if a user is lured to a malicious website while logged into their Joomla site.

Technologies: [Joom Donation Events Booking](https://junglewise.ai/threats/technologies/events-booking). Vendors: [Joom Donation](https://junglewise.ai/threats/vendors/joom-donation).

## Quick answers

**Is CVE-2026-60025 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-60025 being exploited in the wild.

**How severe is CVE-2026-60025?** Informational severity, with a CVSS score of 0, published 17 July 2026.

**Which products and versions are affected?** Joom Donation Events Booking 1.0 through 5.7.9.

**Is there a fix for CVE-2026-60025?** A patch was published on 2026-07-15: Version 5.8.0 released to address the issue. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-60025 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-60025?** Check whether you run Joom Donation Events Booking at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## Technical details

A Cross-Site Request Forgery (CSRF) vulnerability exists in the frontend file upload endpoint of the Events Booking extension for Joomla in versions prior to 5.8.0. The affected component fails to implement or validate anti-CSRF tokens (synchronizer tokens) during file upload operations. An attacker can exploit this by crafting a malicious webpage that triggers a POST request to the file upload endpoint; if a site user with appropriate permissions visits this page while authenticated, the browser will automatically include their session cookies, executing the upload. This could lead to unauthorized file storage on the server. The issue is resolved in version 5.8.0.

## Affected products

- joomdonation.com Events Booking extension for Joomla 1.0 through 5.7.9

## Timeline

- 2026-07-15: patched: Version 5.8.0 released to address the issue.
- 2026-07-17: disclosed: CVE-2026-60025 published.

## References

- [https://joomdonation.com/joomla-extensions/events-booking-joomla-events-registration.html](https://joomdonation.com/joomla-extensions/events-booking-joomla-events-registration.html)

## Related threats

- [Joomdonation Events Booking improper access control in invoice downloads](https://junglewise.ai/threats/cve-2026-63047-joomdonation-events-booking-improper-access-control-in-invoice)
- [Joomdonation Events Booking insecure default media upload permissions](https://junglewise.ai/threats/cve-2026-60024-joomdonation-events-booking-insecure-default-media-upload)
- [JoomDonation Events Booking user enumeration in Joomla extension](https://junglewise.ai/threats/cve-2026-58149-joomdonation-events-booking-user-enumeration-in-joomla-extension)