Custom Tables CVE-2026-105606

The target Joomla site must have the Custom Tables extension (version below 3.7.8) installed AND must expose a PUBLIC, unauthenticated Custom Tables submission form; against such sites the attacker uploads a polyglot file with an attacker-controlled extension to the web-accessible tmp directory, and the response discloses the stored path. The key limiting factor is the public submission form - installs without a publicly reachable form are not exploitable through this path. A second scoping factor: the file is served as static content by default, so the impact is hosting attacker-controlled content rather than code execution, unless the server is additionally configured to execute files (e.g. PHP) from the tmp directory, which is not the default.

The signals conflict and must be weighed carefully. The supplied CVSS 4.0 base score of 9.5 is driven by all three vulnerable-system impacts and all three subsequent-system impacts being rated High (VC:H/VI:H/VA:H/SC:H/SI:H/SA:H), which implies full compromise. The description does not support that: it states the uploaded file is 'served as static content' by default, so the realistic primary impact is an unauthenticated arbitrary file WRITE to a web-accessible directory (integrity), not code execution or data destruction - confidentiality and availability impact appear minimal, so the headline 9.5 looks inflated relative to the described mechanism. Working in the attacker's favor: AV:N, AC:L, PR:N and UI:N mean this is reachable by remote unauthenticated attackers with no user interaction, and the vuln.today Decision label is act_now, so it should be prioritized. Working against widespread mass exploitation: AT:P reflects a real precondition - the target must expose a PUBLIC Custom Tables submission form - so only a subset of installs are exploitable. No EPSS score, no CISA KEV listing, and no verified exploit code were provided, so there is no evidence of active exploitation; the act_now label rests on the ease and unauthenticated nature of the write rather than on observed attacks. Net: treat as a genuine priority for sites running Custom Tables with a public submission form, but understand the concrete impact is attacker-controlled-content hosting (phishing/malware under the victim's domain) rather than confirmed remote code execution.

A remote unauthenticated attacker locates a Joomla site running a vulnerable Custom Tables extension that exposes a public submission form, then submits a polyglot file with an attacker-chosen extension. The server stores it in the web-accessible tmp directory and discloses the stored path in the response, letting the attacker serve phishing or malware pages from the victim's own domain. No public exploit code was identified in the provided data, and exploitation requires that a public submission form be present.