EUVD-2026-62434
GHSA-c2jh-c375-pjcv
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Remote unauthenticated upload with no user interaction (AV:N/AC:L/PR:N/UI:N); uploaded code executes on the web host beyond the vulnerable component so scope changes (S:C) with full C/I/A impact.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
2DescriptionCVE.org
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
AnalysisAI
Unauthenticated arbitrary file upload in the YOOtheme Zoo content-builder extension for Joomla (versions before 4.1.64) allows remote attackers to upload arbitrary files, including web shells, because the image element only validates the client-supplied Content-Type header against the image MIME group rather than the actual file contents or extension. Rated CVSS 4.0 base 10.0 with full confidentiality, integrity, and availability impact plus scope change, this is a critical pre-authentication flaw. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | The vulnerable path is the Zoo 'image element' upload feature: exploitation requires that a Zoo image element / upload endpoint be reachable by the attacker and accept submissions without prior authentication, and that the attacker set the HTTP Content-Type header to a value within the image MIME group (e.g. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | All available signals point to genuine high priority: the CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N) indicates network-reachable, low-complexity exploitation with no privileges and no user interaction, and the impact metrics (VC:H/VI:H/VA:H, SC:H/SI:H/SA:H) reflect that a successful upload of executable code yields full compromise of the host. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | A remote, unauthenticated attacker locates a Joomla site running a vulnerable Zoo image element and submits a POST request uploading a PHP web shell while setting the request Content-Type header to an image type such as image/jpeg. The server accepts the file based solely on that header, storing the executable script in a web-accessible directory; the attacker then requests the uploaded file's URL to execute commands and gain a foothold. … |
| Remediation | Vendor-released patch: 4.1.64 - upgrade the Zoo extension to version 4.1.64 or later, which is the primary and complete fix. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all Joomla deployments using Zoo extension and immediately disable the extension or restrict access to administrative users only. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
More in Zoo Extension For Joomla
View allSQL injection in the YOOtheme Zoo content-construction extension for Joomla allows unauthenticated remote attackers to i
Stored cross-site scripting in Zoo Extension for Joomla (all versions before 4.1.66) allows unauthenticated remote attac
Unauthenticated arbitrary directory listing in the Gallery element of the YOOtheme Zoo extension for Joomla exposes serv
Reflected XSS and open redirect in yootheme.com's Zoo extension for Joomla (versions prior to 4.1.66) allow remote attac
Open redirect in YOOtheme Zoo extension for Joomla (versions prior to 4.1.64) allows unauthenticated network attackers t
Same technique File Upload
View allShare
External POC / Exploit Code
Leaving vuln.today