Executive brief
JoomGallery is a Joomla image gallery extension used by website administrators to manage and display photo galleries. The TUS upload endpoint in versions before 4.4.2 allows attackers to upload arbitrary files without authentication, though filename and extension are restricted, limiting immediate code execution risk unless the server is misconfigured.
Technical details
The vulnerability is an unauthenticated arbitrary file upload flaw in the TUS (Tusd) endpoint of JoomGallery versions prior to 4.4.2. While the TUS endpoint permits file uploads without authentication, the vulnerability is mitigated by server-side restrictions on both filename and file extension, preventing direct control over the uploaded file's name or type. Code execution is possible only under non-standard server configurations. The vulnerability has been patched in version 4.4.2, released on September 18, 2026.
Affected products
- JoomGallery JoomGallery < 4.4.2
Timeline
- 2026-09-15: disclosed
- 2026-09-18: patched: Version 4.4.2 released as security update