Which versions of iCagenda Joomla Extension are affected by EUVD-2026-38109?

Organizations operating Joomla websites with iCagenda extension versions 1.0.0-3.9.14 or 4.0.0-4.0.7 face immediate risk of complete web application compromise through remote file upload exploitation…

Is there a public PoC exploit available for EUVD-2026-38109?

Yes, a public proof-of-concept exploit is available for EUVD-2026-38109. Prioritise patching immediately. EPSS: 0.4%.

How to fix or mitigate EUVD-2026-38109?

Within 24 hours: Conduct inventory scan of all Joomla deployments for iCagenda 1.0.0-3.9.14 or 4.0.0-4.0.7; immediately disable the extension or block attachment upload endpoints at firewall/WAF level; review access logs for indicators of exploitation. Within 7 days: Implement strict file type whitelisting (non-executable extensions only) on remaining upload handlers; configure web server to prevent script execution in upload directories; establish daily vulnerability monitoring for vendor patch announcements. Within 30 days: Evaluate alternative extensions or Joomla versions; develop upgrade pathway once vendor releases patched version.

iCagenda Joomla Extension EUVD-2026-38109

Q: What is the CVSS score of EUVD-2026-38109?

EUVD-2026-38109 has a CVSS 4.0 base score of 10.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red. EPSS exploitation probability: 0.4%.

| CVE-2026-48939 CRITICAL

Improper Access Control (CWE-284)

2026-06-20 Joomla

GHSA-4rh3-rmh3-hv6h

Authentication Bypass PHP Icagenda Extension For Joomla

10.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

10.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

vuln.today AI

9.8 CRITICAL

Description and Authentication Bypass tag indicate the upload endpoint is reachable remotely without credentials or user interaction, and PHP execution yields full confidentiality, integrity, and availability impact on the webserver.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Lifecycle Timeline

Added to CISA KEV

Jul 10, 2026 - 17:16 CISA

Analysis Generated

Jun 22, 2026 - 07:52 vuln.today

CVE Published

Jun 20, 2026 - 11:56 cve.org

CRITICAL 10.0

DescriptionCVE.org

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Articles & Coverage 2

medium.com CVE-2026-48939: Critical File Upload Vulnerability in Joomla iCagenda Extension Jul 13, 2026 POC CVE-2026-48939: Pre-Auth Arbitrary File Upload RCE in iCagenda Joomla Extension (CVSS 10.0) Jul 06, 2026

AnalysisAI

Arbitrary PHP file upload in the iCagenda extension for Joomla enables remote unauthenticated attackers to abuse the event attachment feature to upload and execute server-side code, leading to full web application compromise. The flaw affects iCagenda 1.0.0-3.9.14 and 4.0.0-4.0.7 and carries a CVSS 4.0 score of 10.0 with exploitation marked as Attacked (E:A) in the vector, though no public exploit identified at time of analysis and the issue is not currently listed in CISA KEV.

Technical ContextAI

iCagenda is a third-party events/calendar component for the Joomla CMS, written in PHP and installed inside a Joomla site's /administrator and /components tree (CPE cpe:2.3:a:icagenda.com:icagenda_extension_for_joomla). The vulnerability is rooted in CWE-284 (Improper Access Control) over the extension's file attachment handler: the upload routine fails to enforce restrictions on the type/extension/MIME of uploaded files, so attackers can submit a .php (or similarly executable) payload through the legitimate attachment feature. Because Joomla stores uploads under a web-accessible path served by the host's PHP interpreter, the uploaded file is directly requestable and executed in the application's security context, turning a file-upload bug into remote code execution. The 'Authentication Bypass' tag combined with PR:N indicates the upload endpoint is reachable without valid Joomla credentials, consistent with the access-control weakness class.

RemediationAI

No vendor-released patch identified at time of analysis - neither the iCagenda site (https://www.icagenda.com/) nor the references (https://nvd.nist.gov/vuln/detail/CVE-2026-48939, https://vuldb.com/vuln/372536) list a fixed version, so administrators should monitor the vendor page for a release beyond 4.0.7 and update as soon as it is published. Until a patched build exists, the most direct compensating control is to disable the iCagenda attachment feature in the component's configuration (which removes the vulnerable upload path at the cost of legitimate event attachments) or uninstall the extension entirely if events functionality is non-essential. As a defense-in-depth measure, restrict access to the iCagenda upload endpoints via a WAF rule or webserver location block that denies POSTs with executable extensions (.php, .phtml, .phar, .php5, .inc) and configure the Joomla upload directory under iCagenda's storage path to be served as static content with PHP execution disabled (for Apache, an .htaccess with 'php_flag engine off' or RemoveHandler for php extensions; for nginx, a location block returning the file without passing to php-fpm) - this neutralizes execution even if upload succeeds, with the trade-off that any legitimate .php inside that tree will also stop running.