Which versions of Phoca Download are affected by EUVD-2026-43167?

The Phoca Download extension for Joomla contains a critical remote code execution vulnerability (CVE-2026-57828, CVSS 9.0) that allows authenticated users to upload and execute arbitrary code on the…

How to fix or mitigate EUVD-2026-43167?

Within 24 hours: Disable the Phoca Download extension in Joomla admin panel or immediately disable self-registration if the extension is business-critical. Within 7 days: Implement Web Application Firewall rules blocking file uploads to Phoca Download endpoints; audit server logs and file system for unauthorized PHP or executable files in upload directories. Within 30 days: Evaluate alternatives to Phoca Download or plan Joomla migration; establish baseline for file integrity monitoring on upload directories.

Phoca Download EUVD-2026-43167

Q: What is the CVSS score of EUVD-2026-43167?

EUVD-2026-43167 has a CVSS 4.0 base score of 9.0 (Critical). CVSS vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X. EPSS exploitation probability: 0.3%.

| CVE-2026-57828 CRITICAL

Unrestricted Upload of File with Dangerous Type (CWE-434)

2026-07-11 Joomla

GHSA-wjv4-xh6c-w4j7

File Upload Phoca Cz Phoca Download Extension For Joomla Phoca Cz

9.0

CVSS 4.0 · Vendor: Joomla

Severity by source

Vendor (Joomla) PRIMARY

9.0 CRITICAL

CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

vuln.today AI

9.9 CRITICAL

Network-reachable upload needing only a low-privilege registered account (PR:L, AC:L, UI:N); RCE escapes the app into the OS/web-server context, so S:C with full C/I/A impact.

3.1 AV:N/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

4.0 AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

Primary rating from Vendor (Joomla).

CVSS VectorVendor: Joomla

Attack Vector

Network

Attack Complexity

Low

Privileges Required

Low

User Interaction

None

Scope

Lifecycle Timeline

Analysis Generated

Jul 11, 2026 - 10:15 vuln.today

CVE Published

Jul 11, 2026 - 09:27 cve.org

CRITICAL 9.0

DescriptionCVE.org

The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

AnalysisAI

Arbitrary file upload in the Phoca Download extension for Joomla lets any authenticated registered user upload executable files (e.g. PHP) that the server will run, yielding full remote code execution. The flaw is scored 9.0 (CVSS 4.0) and is exploitable over the network by low-privilege accounts, so any site permitting self-registration is directly at risk. A public technical write-up describing the RCE technique exists, though no active exploitation has been confirmed by CISA KEV.

Technical ContextAI

Phoca Download is a widely used file/download management extension for the Joomla CMS, providing categorized file libraries and front-/back-end upload capabilities. The root cause is CWE-434 (Unrestricted Upload of File with Dangerous Type): the extension's upload handler fails to adequately validate file type, extension, or content, allowing a dangerous server-executable file to be stored inside the web root. Because Joomla runs on PHP, an uploaded .php (or double-extension/MIME-bypass) payload placed in a web-accessible directory is executed by the interpreter on request, converting a storage flaw into code execution in the web server's context. The affected component is identified by CPE cpe:2.3:a:phoca.cz:phoca.cz_phoca_download_extension_for_joomla:*, i.e. all versions prior to the vendor's fix.

RemediationAI

Update the Phoca Download extension to the latest version from the vendor via https://www.phoca.cz/phocadownload and the Joomla Extensions updater; no exact fixed version number was provided in the source data, so verify the patched release directly with Phoca before deploying (No vendor-released patch version identified with certainty at time of analysis). As compensating controls until patched: disable or tighten front-end user self-registration and revoke upload permissions from low-privilege Joomla user groups so untrusted 'registered' accounts cannot reach the upload feature (trade-off: blocks legitimate user submissions); configure the web server to refuse execution of scripts in Phoca's upload/media directories (e.g. Apache 'php_admin_flag engine off' or removing handler mappings, nginx location blocks denying .php) which stops uploaded payloads from running (trade-off: none for static files, but breaks any legitimate scripts stored there); and enforce a server-side allow-list of safe file extensions/MIME types at a WAF or upload-proxy layer. Review the site for already-uploaded webshells before and after remediation.