EUVD-2026-45198
GHSA-3g7p-grjw-p9pj
Severity by source
AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CSRF is network, low-complexity, no attacker privileges but needs victim interaction (UI:R); integrity high from forced upload, confidentiality/availability lower absent confirmed RCE or file-type bypass.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
4DescriptionCVE.org
The Joomla extension Events Booking prior version 5.8.0 had an frontend file upload endpoint that lacked CSRF protection.
AnalysisAI
Cross-site request forgery in the Events Booking extension for Joomla (all versions through 5.8.0) lets a remote attacker abuse an unauthenticated frontend file-upload endpoint that lacks anti-CSRF token validation. By luring a logged-in victim to a malicious page, an attacker can force the victim's browser to submit a forged upload request, potentially planting malicious files on the server; the CVSS 3.1 base score is 8.8 with high confidentiality, integrity, and availability impact. There is no public exploit identified at time of analysis and the EPSS probability is very low (0.10%, 1st percentile).
Technical ContextAI
Events Booking (developed by JoomDonation, CPE cpe:2.3:a:joomdonation.com:events_booking_extension_for_joomla) is a widely used commercial events registration and booking component for the Joomla CMS. The root cause is CWE-352 (Cross-Site Request Forgery): a frontend file-upload endpoint accepts state-changing POST requests without validating a per-session/per-form anti-CSRF token (in Joomla, JSession::checkToken / JForm token). Because Joomla exposes frontend upload handlers to site visitors, the missing token check means the server cannot distinguish a legitimate user-initiated upload from one forged by a third-party site, and a file upload primitive additionally raises the risk of introducing attacker-controlled content onto the server.
RemediationAI
Upgrade the Events Booking extension to version 5.8.0 or later, which adds CSRF protection to the frontend file-upload endpoint (Vendor-released patch: 5.8.0). Obtain the update from the vendor at https://joomdonation.com/joomla-extensions/events-booking-joomla-events-registration.html and apply it through the Joomla extension manager. If immediate patching is not possible, reduce exposure by restricting or disabling frontend upload functionality on Events Booking forms (accepting that users can no longer attach files to bookings), placing the affected frontend endpoints behind authentication or IP allow-listing, and deploying a WAF rule that requires a valid Joomla form token on the upload endpoint (note this can break legitimate uploads if the token name changes). As defense in depth, tighten server-side upload validation (allow-list of extensions/MIME types, store uploads outside the web root, disable script execution in the upload directory) to limit impact if a forged upload succeeds.
Unauthenticated media upload in the Events Booking extension for Joomla (versions 1.0 through 5.8.0, developed by joomdo
Unauthorized invoice disclosure in the Events Booking extension for Joomla (versions 5.0 through 5.8.1) lets remote unau
Unauthenticated user enumeration in the Events Booking extension for Joomla (versions 1.0 through 5.8.0) exposes registe
Same weakness CWE-352 – Cross-Site Request Forgery (CSRF)
View allShare
External POC / Exploit Code
Leaving vuln.today