Executive brief
jDownloads, a popular file management extension for the Joomla website platform, contained a security flaw that allowed anyone on the internet to upload files to a web server without logging in. This occurred because a testing script was accidentally included in several software releases. An attacker could use this to host malicious content on the site, fill up server storage, or potentially take full control of the website if the server is configured to run certain types of uploaded files.
Technical details
A standalone test script, 'upload-handler.php', was inadvertently included in the jDownloads 4.1.x branch. This script lacks essential security checks, including the Joomla '_JEXEC' guard, session validation, CSRF tokens, and permission checks. While the script contains a hardcoded allow-list that excludes '.php' files, it permits the upload of archives, documents, and executables (e.g., .exe, .msi). An attacker can achieve Remote Code Execution (RCE) if the server is misconfigured to execute secondary extensions (e.g., .php.jpg) or if the attacker can leverage the uploaded files in combination with other vulnerabilities. The vulnerability is resolved in version 4.1.6, which removes the offending file and associated test directories.
Affected products
- jDownloads jDownloads extension for Joomla 4.1.0 - 4.1.5
Timeline
- 2026-07-16: disclosed: Vulnerability reported privately to the developer.
- 2026-07-18: patched: jDownloads version 4.1.6 released to remove the vulnerable script.
- 2026-07-20: advisory: CVE-2026-61900 published.