Which versions of JMedia (Joomla) are affected by CVE-2026-60032?

The ThemeXpert JMedia extension for Joomla contains a critical vulnerability (CVE-2026-60032, CVSS 9.4) that could allow compromised administrator accounts or insider threats to seize complete…

How to fix or mitigate CVE-2026-60032?

Within 24 hours, immediately disable the ThemeXpert JMedia extension on all affected Joomla instances and review administrator account activity for suspicious behavior or unauthorized changes; disable any unused or suspicious admin accounts. Within 7 days, deploy Web Application Firewall (WAF) rules to block executable file uploads to web-accessible directories, implement file integrity monitoring on the web root, and review upload logs for evidence of exploitation. Within 30 days, evaluate and migrate to an alternative actively maintained media management solution, monitor vendor advisories for a patched version of ThemeXpert JMedia, and implement privileged access management (PAM) controls to reduce admin account exposure.

JMedia (Joomla) CVE-2026-60032

Q: What is the CVSS score of CVE-2026-60032?

CVE-2026-60032 has a CVSS 4.0 base score of 9.4 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.2%.

EUVD-2026-46054 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-20 Joomla

GHSA-3qgh-5pfw-cjfw

File Upload Jmedia Extension For Joomla Themexpert Com

9.4

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.4 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.1 CRITICAL

Network-reachable upload requiring a privileged backend account (PR:H) with low complexity; RCE breaks out of the app to the host, so scope changes (S:C) with full C/I/A impact.

3.1 AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:20 vuln.today

CVE Published

Jul 20, 2026 - 18:09 cve.org

CRITICAL 9.4

DescriptionCVE.org

The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits.

AnalysisAI

Authenticated arbitrary file upload in the ThemeXpert JMedia media-manager extension for Joomla lets an authenticated privileged user (PR:H) write executable files to the server and achieve remote code execution. Uploads accept executable content and polyglot filenames, and the extension's chmod handling fails to strip execute bits, so a planted file can be directly invoked by the web server. Rated CVSS 4.0 9.4 (Critical); no public exploit identified at time of analysis and it is not listed in CISA KEV.

Technical ContextAI

JMedia is a media-management extension for the Joomla CMS (CPE cpe:2.3:a:themexpert.com:jmedia_extension_for_joomla). The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the upload handler does not adequately restrict file type or content, permitting server-side scripts (e.g. PHP) to be written into a web-accessible location. Two compounding weaknesses are called out - polyglot filenames that evade naming/extension checks, and a chmod routine that does not strip execute bits - so an uploaded artifact retains executable permissions and can be requested and run by the PHP/Apache-Nginx stack serving Joomla.

RemediationAI

No vendor-released patch version is identified at time of analysis, and the sole reference (https://www.themexpert.com/joomla-extensions/joomla-media-manager) is a product page rather than an advisory, so confirm the latest release and any changelog directly with ThemeXpert before upgrading. Because PR:H access is required, the strongest compensating controls target account exposure and file execution: restrict and audit Joomla backend accounts that hold media-upload privileges, enforce strong/MFA-backed admin authentication, and place the /administrator interface behind an IP allowlist or VPN (trade-off: remote admins lose direct access). At the web-server layer, deny execution of scripts within Joomla media/upload directories - e.g. an Apache 'php_admin_flag engine off' / removing handler mappings or an Nginx location block that returns 403 for .php under the upload path (trade-off: breaks any legitimate scripts placed there) - and ensure the OS mount or directory is not marked executable. A WAF rule blocking upload of executable/polyglot content adds defense but can be bypassed and should not be the sole control.