OrdaSoft Joomla Gallery CVE-2026-88856

Requires a privileged/authenticated Joomla backend account able to reach the OrdaSoft Joomla Gallery extension's task=update_osgallery endpoint (PR:H). The vulnerable OrdaSoft Joomla Gallery (free or paid) extension must be installed at a version below 6.2.7. No user interaction and no non-default configuration are needed beyond the extension being present and the attacker possessing the privileged role; the code path calls the JSON 'method' value as a PHP function with the 'package' value as its argument with no is_callable() or allow-list check, so exploitation is otherwise unconditional. The privilege requirement is the primary limiting factor - this is not exploitable by anonymous internet users.

This is a genuine high-priority flaw where it applies. The mechanism is unambiguous and severe: updateOSGallery() (reached via task=update_osgallery) takes an attacker-supplied JSON body and invokes the value of the 'method' field as a live PHP function with the 'package' value as its argument, with no allow-list and no is_callable() gate - meaning system, exec, shell_exec, and passthru are directly reachable. That is textbook CWE-94 code injection escalating to OS command execution. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H, 9.4) is credible: network-reachable, low complexity, no user interaction, full triple-impact plus subsequent-system compromise via the shell-out. The key tempering signal is PR:H - this is authenticated, privileged exploitation, consistent with the description's 'Authenticated, Privileged Remote Code Execution' phrasing, so it requires an attacker who already holds a privileged Joomla backend account rather than an anonymous internet visitor. No EPSS score, no CISA KEV listing, and no public exploit code are present in the supplied intelligence, so there is no evidence of active exploitation; the only reference is the OrdaSoft.com homepage (no dedicated advisory URL). Net: high technical severity gated by a privilege requirement, with exploitation status currently 'no public exploit identified at time of analysis.'

An attacker holding a privileged Joomla backend account (or one obtained via account compromise) sends a crafted JSON POST to the endpoint reached by task=update_osgallery, setting the 'method' field to 'system' and the 'package' field to an OS command. The extension calls system('<command>') directly, executing arbitrary commands as the web-server user. No public proof-of-concept is referenced, but the flaw is trivial to weaponize once backend access exists given the absence of any is_callable() or allow-list check.