EUVD-2026-57152
GHSA-x9hv-www7-w846
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
No authentication required (PR:N, AV:N); file overwrite and permission reassignment warrant I:H; file read gives C:L; file deletion gives A:L within extension scope.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
Lifecycle Timeline
1DescriptionCVE.org
Joomla Extension - tabaoca.org - Improper ACL implementation allows file operations in Cotton Cloud < 2.0.2 - Unauthenticated users could perform various file-related operations (read, delete, overwrite, re-assign permissions) on every file managed within the extension.
AnalysisAI
Improper access control in the Cotton Cloud Joomla extension (versions below 2.0.2) by tabaoca.org exposes a broken ACL implementation that allows unauthenticated remote attackers to perform arbitrary file operations - reading, deleting, overwriting, and reassigning permissions - on every file managed within the extension. The network-accessible, zero-authentication attack vector (CVSS 4.0 AV:N/AC:L/PR:N/UI:N) makes exploitation trivially low-effort against any Joomla site running an unpatched Cotton Cloud installation. No public exploit code or active exploitation has been identified at time of analysis, though the attack surface is broad enough that no specialized tooling is required.
Technical ContextAI
Cotton Cloud is a third-party Joomla CMS file management extension developed by tabaoca.org (CPE: cpe:2.3:a:tabaoca.org:cotton_cloud_extension_for_joomla:*:*:*:*:*:*:*:*). The root cause is CWE-284 (Improper Access Control), specifically a defective Access Control List implementation within the extension's file management layer. Joomla's component framework provides ACL hooks that extension authors must correctly wire into their controllers; Cotton Cloud's implementation fails to enforce these checks before processing file management requests, exposing the full CRUD surface of its file manager - read, delete, overwrite, and permission reassignment - to unauthenticated callers. This is a classic authorization bypass: the functionality exists and works, but the gatekeeping logic is absent or non-functional.
RemediationAI
Upgrade Cotton Cloud to version 2.0.2 or later immediately, as this release contains the corrected ACL implementation per the CVE description. Vendor release and advisory details are available at https://www.tabaoca.org/. As an interim compensating control while patching is arranged, restrict HTTP access to the Cotton Cloud component's file management controller paths via server-level rules (e.g., deny access to the relevant Joomla component path in Apache or nginx configuration) - note this will break legitimate file management functionality for site administrators. Alternatively, disable the Cotton Cloud extension entirely through the Joomla Extension Manager until patching is feasible. No workaround is known that fully preserves extension functionality while preventing unauthenticated file access.
Same weakness CWE-284 – Improper Access Control
View allSame technique Authentication Bypass
View allShare
External POC / Exploit Code
Leaving vuln.today