AcyMailing Enterprise CVE-2026-94131

Exploitable when an AcyMailing Enterprise instance older than 11.1.0 exposes a subscription or profile form containing a file-type custom field that is publicly reachable (no authentication, per PR:N). The attacker stores an arbitrary path (including traversal outside the upload folder) in that field and then clears the field, which is what triggers AcyMailing's file-deletion routine on the attacker-supplied path. Limiting factors: a file-type custom field must actually be configured and web-accessible, and the deletion fires on the field-clear workflow (reflected as AT:P) rather than on any arbitrary request - so a default install without such a custom field is not exploitable. Impact is destructive (file deletion, e.g. configuration.php) rather than data theft.

This is a genuinely serious flaw whose severity is well-supported by the CVSS 4.0 vector CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H: remote, network-reachable, low complexity, no privileges and no user interaction, delivering high integrity and availability impact. The AT:P (attack requirement 'present') modifier reflects the one non-trivial precondition - the vulnerable file-type custom field must exist on a public subscription form and the deletion is triggered when the field is cleared - which is why the score lands at 8.3 rather than near 9.5. No EPSS score, no CISA KEV listing, and no public POC were provided, so there is no evidence of active exploitation or automated weaponization; risk is currently theoretical-but-high-plausibility given how mechanically simple the attack is. One clear data conflict: the CWE is CWE-89 (SQL Injection) and a 'SQLi' tag is present, but the description unambiguously describes arbitrary file deletion via attacker-controlled paths (a path-traversal / external-control-of-filename class issue, CWE-22/CWE-73), not SQL injection - the classification should be treated as wrong. Net: a real priority for exposed Joomla sites running AcyMailing subscription forms, but not a confirmed in-the-wild emergency.

An attacker visits a public AcyMailing subscription or profile-edit form that includes a file-type custom field, submits a crafted value pointing at an application file such as ../configuration.php, then clears the field so AcyMailing performs its cleanup deletion on the attacker-controlled path. The referenced file is removed from disk outside the intended upload directory, breaking the Joomla site. No public exploit code was identified at time of analysis.