Which versions of JDownloads are affected by CVE-2026-61900?

The JDownloads 4.1 extension for Joomla contains a critical unauthenticated remote code execution vulnerability (CVSS 10.0) allowing attackers to place executable files and gain full server access…

How to fix or mitigate CVE-2026-61900?

Within 24 hours: conduct a complete inventory of all Joomla installations running JDownloads 4.1, prioritizing internet-facing systems, and immediately disable or uninstall the vulnerable extension. Within 7 days: contact JDownloads vendor to confirm patching timeline; if patch timeline extends beyond 30 days, evaluate alternative download-management solutions or implement network isolation to restrict external access to affected systems. Within 30 days: either deploy the patched JDownloads release once available, or complete migration to a replacement extension with security testing in a staging environment before production redeployment.

JDownloads CVE-2026-61900

Q: What is the CVSS score of CVE-2026-61900?

CVE-2026-61900 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

EUVD-2026-46085 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-20 security@joomla.org

GHSA-65x2-cg74-8x2m

File Upload

10.0

CVSS 4.0 · Vendor: joomla

Severity by source

Vendor (joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.8 CRITICAL

Unauthenticated network-reachable upload yields code execution as the web user with no interaction, so AV:N/AC:L/PR:N/UI:N and full C/I/A; scope kept Unchanged as impact is on the vulnerable host component.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (joomla).

CVSS VectorVendor: joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 20, 2026 - 19:30 vuln.today

CVE Published

Jul 20, 2026 - 19:17 cve.org

CRITICAL 10.0

DescriptionCVE.org

The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE.

AnalysisAI

Unauthenticated file upload in the JDownloads download-manager extension for Joomla allows a remote attacker to place an executable file (e.g. a PHP web shell) on the server and achieve full remote code execution. The flaw affects the JDownloads 4.1 line per the referenced advisory and requires no authentication or user interaction, so any internet-reachable Joomla site running the extension is exposed. There is no public exploit identified at time of analysis and it is not listed in CISA KEV, but the trivial exploitation profile makes it a high-priority patching target.

Technical ContextAI

JDownloads is a third-party download-management extension for the Joomla CMS, written in PHP and typically exposed through the site's public front end. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): an upload handler accepts attacker-supplied files without adequately validating file type, extension, or content, allowing a script interpretable by the web server (such as .php) to be written into a web-accessible directory. Because Joomla runs under a PHP interpreter, an uploaded PHP file can be requested directly and executed with the privileges of the web server process, converting a file-write primitive into arbitrary code execution. No specific affected-component CPE was supplied in the input, so the exact package identifier is inferred from the vendor name and the referenced blog rather than confirmed NVD CPE data.

RemediationAI

Upgrade JDownloads to the latest vendor-released version obtained from https://www.jdownloads.com/; no vendor-released patched version number is independently confirmed in the provided data, so verify the fixed release directly with the vendor advisory referenced at https://mysites.guru/blog/jdownloads-4-1-unauthenticated-upload-flaw/ before deploying. Until a confirmed patch is applied, disable or uninstall the JDownloads extension if it is not essential, since that fully removes the vulnerable upload handler at the cost of losing download-management functionality. If the extension must remain enabled, restrict access to the JDownloads upload endpoints at the web-server or WAF layer and block requests that submit executable extensions (.php, .phtml, .phar, etc.), and configure the server so files in the JDownloads upload/storage directories cannot be executed as PHP (e.g. an interpreter-disabling directive on that path) - this prevents an uploaded shell from running but may break features that rely on server-side processing of uploads. Review web and upload directories for already-planted files, as compensating controls do not remediate a prior compromise.