Quick answers
- Is CVE-2026-60032 exploited in the wild?
- No. Junglewise Threat Intelligence has no report of CVE-2026-60032 being exploited in the wild.
- How severe is CVE-2026-60032?
- Informational severity, with a CVSS score of 9.4, published 20 July 2026.
- Which products and versions are affected?
- ThemeXpert JMedia 1.0-1.5.4.
- Is there a fix for CVE-2026-60032?
- No fixed version is recorded yet. Check the vendor's advisory in the references below. If you run it, Junglewise drafts a mitigation that fits your setup and applies it once you approve, with senior security engineers behind it.
- How is CVE-2026-60032 attacked?
- It is attacked over the network, in a software library.
- Am I affected by CVE-2026-60032?
- Check whether you run ThemeXpert JMedia at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.
Technical details
ThemeXpert JMedia versions 1.0 through 1.5.4 suffer from an unrestricted file upload vulnerability (CWE-434). The extension fails to properly validate uploaded files, allowing for the upload of executable scripts, including those using polyglot filenames to bypass filters. Additionally, the application's permission management (chmod) fails to strip execute bits from uploaded files. An authenticated attacker with high privileges (PR:H) can leverage this to upload and execute arbitrary PHP code on the server, resulting in full system compromise. The vulnerability is reachable over the network without user interaction.
Affected products
- ThemeXpert JMedia extension for Joomla 1.0-1.5.4
Timeline
- 2026-07-20: advisory: CVE-2026-60032 published by the Joomla! Project