Executive brief
DJ-Classifieds is a popular Joomla extension used to build classified ads, business directories, and listing websites. A security vulnerability allows unauthorized users to upload malicious files to the server without needing to log in. This could allow an attacker to take full control of the website, potentially leading to data theft, site defacement, or the installation of ransomware.
Technical details
The vulnerability exists in the imageupload task within the DJ-Classifieds component due to a lack of authentication and CSRF token validation on the upload endpoint. While the component attempts to block .php extensions and scans for specific strings like '<?php', it fails to account for PHP short tags (e.g., '<?=') or polyglot files (valid images containing PHP code). An attacker can upload a GIF or other allowed file type containing malicious PHP code. On servers configured to execute PHP within whitelisted extensions or via local file inclusion, this leads to full remote code execution. The vulnerability has been observed being probed in the wild. A fix is available in version 3.11.2.
Affected products
- dj-extensions.com DJ-Classifieds extension for Joomla 1.0 through 3.11.1
Timeline
- 2026-07-20: patched: DJ-Classifieds 3.11.2 released to address the flaw.
- 2026-07-20: disclosed: Public disclosure by mySites.guru and NVD publication.
- 2026-07-20: exploited: Reports indicate the endpoint was being hit by automated scanners in the wild prior to the patch.