YOOtheme Zoo CVE-2026-74803

The vulnerable path is the Zoo 'image element' upload feature: exploitation requires that a Zoo image element / upload endpoint be reachable by the attacker and accept submissions without prior authentication, and that the attacker set the HTTP Content-Type header to a value within the image MIME group (e.g. image/jpeg, image/png) while sending non-image executable content. The bypass works because only the client-supplied Content-Type is validated, not file content or extension. Limiting factors that reduce real-world exposure: the target Joomla site must actually expose a Zoo image upload element to unauthenticated users, the upload directory must permit server-side script execution for code execution to follow, and the site must be running Zoo below 4.1.64. Where the upload form is behind authentication or the storage directory forbids script execution, impact is reduced.

All available signals point to genuine high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no privileges and no user interaction, and the impact metrics (VC:H/VI:H/VA:H, SC:H/SI:H/SA:H) reflect that a successful upload of executable code yields full compromise of the host. The base score of 10.0 is consistent with unauthenticated remote code execution via web-shell upload. Countervailing signals: this CVE is NOT in CISA KEV, and there is no evidence of public exploit code (POC=no) or active exploitation, so the practical risk today is driven by ease of weaponization rather than confirmed in-the-wild activity - CWE-434 Content-Type-only bypasses are trivial to reproduce, so exploitation should be treated as imminent once the flaw is public. No EPSS score was provided in the input, so probabilistic exploitation likelihood cannot be quantified here. The description ('image element accepts arbitrary files') strongly corroborates the network, unauthenticated CVSS profile with no obvious contradiction.

A remote, unauthenticated attacker locates a Joomla site running a vulnerable Zoo image element and submits a POST request uploading a PHP web shell while setting the request Content-Type header to an image type such as image/jpeg. The server accepts the file based solely on that header, storing the executable script in a web-accessible directory; the attacker then requests the uploaded file's URL to execute commands and gain a foothold. No public exploit code is currently identified, but the technique is trivial to build.