What is the CVSS score of CVE-2026-60024?

CVE-2026-60024 has a CVSS 3.1 base score of 9.8 (Critical). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H. EPSS exploitation probability: 0.1%.

Which versions of Events Booking are affected by CVE-2026-60024?

The Events Booking extension for Joomla (versions 1.0-5.8.0) contains a critical unauthenticated media upload vulnerability that exposes any affected installation to remote compromise without…

How to fix or mitigate CVE-2026-60024?

Within 24 hours, audit all Joomla instances to identify those running the Events Booking extension versions 1.0-5.8.0 and document current deployment versions. As interim mitigation, disable media upload functionality in Events Booking settings. Within 7 days, apply vendor patch by upgrading the Events Booking extension to version 5.8.0 or later on all affected systems, prioritizing production environments, and verify successful deployment across all instances. Within 30 days, review media upload logs and file system activity from the vulnerable period to detect any unauthorized uploads or injection attempts, and confirm all systems remain patched through repeat inventory.

Events Booking CVE-2026-60024

EUVD-2026-45184 CRITICAL

Initialization of a Resource with an Insecure Default (CWE-1188)

2026-07-17 Joomla

GHSA-4882-55qg-gj5w

Information Disclosure Events Booking Extension For Joomla Joomdonation Com

9.8

CVSS 3.1 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.8 CRITICAL

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vuln.today AI

8.2 HIGH

Unauthenticated remote upload gives high integrity (attacker writes files), minor availability (storage abuse), and no confirmed confidentiality; would rise to C/A:H only if arbitrary executable upload enables RCE.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:L

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:L/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 22:31 vuln.today

CVSS changed

Jul 20, 2026 - 20:22 NVD

9.8 (CRITICAL)

CVE Published

Jul 17, 2026 - 15:47 cve.org

CRITICAL 9.8

CVE Published

Jul 17, 2026 - 15:47 cve.org

UNKNOWN (no severity yet)

DescriptionCVE.org

The Joomla extension Events Booking prior version 5.8.0 did by default allow unauthenticated users to upload media assets.

AnalysisAI

Unauthenticated media upload in the Events Booking extension for Joomla (versions 1.0 through 5.8.0, developed by joomdonation.com) allows any remote user to push media assets to the server without authentication because the feature is enabled by default. Assigned CVSS 9.8 and CWE-1188 (insecure default configuration), the flaw is reported by Joomla/joomdonation and tracked as EUVD-2026-45184; there is no public exploit identified at time of analysis and the EPSS probability is low (0.15%, 4th percentile). Fixed in version 5.8.0.

Technical ContextAI

Events Booking is a commercial event registration and management extension for the Joomla CMS, distributed by joomdonation.com and identified by the CPE cpe:2.3:a:joomdonation.com:events_booking_extension_for_joomla. The root cause is classified as CWE-1188 (Insecure Default Initialization of a Resource): the media/asset upload endpoint ships with a default configuration that grants upload capability to unauthenticated visitors rather than restricting it to authenticated or privileged roles. Because the exposure comes from the shipped default state rather than a code-injection bug, every installation left in its out-of-the-box configuration prior to 5.8.0 is exposed until the setting is changed or the extension is upgraded.

RemediationAI

Upgrade to Events Booking 5.8.0 or later (Vendor-released patch: 5.8.0), obtained from the vendor at https://joomdonation.com/joomla-extensions/events-booking-joomla-events-registration.html. If an immediate upgrade is not possible, remove the unauthenticated default by restricting the media/asset upload capability to authenticated, privileged users in the extension's configuration and, at the web-server or WAF layer, block or require authentication on the upload endpoint used by the extension; the trade-off is that any legitimate front-end/anonymous upload workflow (if used for event submissions) will stop working until reconfigured. As additional hardening, ensure the upload directory disallows script execution (deny .php/executable handlers) so that even a successful upload cannot be run as code. Track the fix via the NVD entry https://nvd.nist.gov/vuln/detail/CVE-2026-60024.