Easydiscuss
CVE-2026-21625
HIGH
Severity by source
AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Primary rating from NVD · only source for this CVE.
CVSS VectorNVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Lifecycle Timeline
2DescriptionCVE.org
User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks are happening.
AnalysisAI
Arbitrary file upload in Joomla's Easy Discuss component allows authenticated attackers to bypass file validation by spoofing extensions, since the component relies solely on extension checks without verifying MIME types. An attacker with user privileges can upload malicious files to achieve remote code execution on affected systems. No patch is currently available.
Technical ContextAI
Classified as CWE-434 (Unrestricted Upload of File with Dangerous Type). Affects Easydiscuss. User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks are happening.
RemediationAI
Monitor vendor advisories for a patch. Validate file types by content. Store uploads outside web root. Restrict network access to the affected service where possible.
More in Easydiscuss
View allSQL injection vulnerability in StackIdeas EasyDiscuss v.5.0.5 and fixed in v.5.0.10 allows a remote attacker to obtain s
The StackIdeas EasyDiscuss (aka com_easydiscuss) extension before 4.0.21 for Joomla!. Rated medium severity (CVSS 5.4),
Easydiscuss fails to enforce access control restrictions on custom forum post fields when outputting data in JSON format
Insufficient input validation in the Easy Discuss component for Joomla allows authenticated users to inject persistent c
Stored cross-site scripting in Joomla's Easy Discuss component allows authenticated users to inject malicious scripts in
Share
External POC / Exploit Code
Leaving vuln.today