DJ-Classifieds CVE-2026-105603

Exploitation requires a running Joomla site with the DJ-Classifieds extension at a version below 3.11.3 and a reachable account: the CVSS vector's PR:L indicates a low-privileged authenticated user (e.g., a registered site user able to reach the extension's upload feature), so sites that permit public self-registration materially lower the barrier. Note the description's 'unprivileged' wording conflicts with PR:L - confirm the real privilege requirement with the vendor. The primary limiting factor is that authentication/account access is needed (per PR:L) and that the specific DJ-Classifieds posting/upload feature must be exposed; no user interaction is required (UI:N). The exact triggering parameter and filter-bypass method are not described in the available sources.

This is a genuine high-priority issue rather than a CVSS-inflated one. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:L/UI:N) describes a network-reachable, low-complexity attack needing only low-level authentication and no user interaction, and the impact is full RCE on the hosting server - the worst outcome for a web application. The vuln.today Decision label is act_now, reinforcing urgency. However, key exploitation signals are MISSING: no EPSS probability is provided, there is no CISA KEV listing, and no POC/exploit reference appears in the input, so exploitation likelihood cannot be quantified from the data - urgency here rests on the act_now decision label and the severity/mechanism, not on observed exploitation. There is also an internal conflict: the CVSS vector specifies PR:L (authenticated, low privileges) while the free-text description calls this an 'unprivileged file upload' - these disagree on whether any authentication is actually required; the PR:L vector is the structured signal and is treated as authoritative, but this discrepancy should be verified with the vendor. Net: treat as act_now for any Joomla site running DJ-Classifieds that allows user registration.

An attacker registers or uses an existing low-privileged Joomla account on a site running DJ-Classifieds below 3.11.3 and abuses the extension's file-upload functionality to upload a malicious PHP file (web shell) that bypasses type restrictions. The attacker then requests the uploaded file, achieving arbitrary code execution on the web server. No public exploit was identified in the provided data, and the specific upload parameter or bypass technique is not described in the available sources.