Joomla Event Manager EUVD-2026-66866

Exploitation requires an authenticated Joomla administrator session (CVSS PR:H) with access to the Event Manager extension's administrator 'source' model file-write function - this is the exact feature that permits saving dangerous file types including PHP. The target must be running Joomla Event Manager at a version below 5.0.1. Limiting factors: the attacker cannot succeed without high back-end privileges, so the vulnerability is gated behind whatever protects administrator accounts (credentials, MFA, IP restrictions); no user interaction from a victim is needed (UI:N) and the vector is network-reachable (AV:N) via the standard Joomla admin interface. There is no indication that a non-default configuration is required - the vulnerable source model appears to be standard extension functionality.

The signals are moderately consistent but not maximal. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N with full VC/VI/VA and subsequent-system SC/SI/SA all High) yields 9.4 - critical - but the decisive mitigating factor is PR:H: the attacker must already hold administrator-level access to the Joomla back end, which sharply narrows the realistic threat population to compromised-credential or malicious-insider scenarios rather than opportunistic internet-wide exploitation. No EPSS score, KEV listing, POC, or SSVC decision data was supplied, so there is no evidence of active or automatable exploitation. In practice this is a high-impact-but-privilege-gated post-authentication RCE: a genuine priority for any environment where Joomla admin access is shared, delegated, or protected only by weak credentials, but lower urgency than an unauthenticated network RCE. Note the tension worth flagging: the 4.0 vector asserts subsequent-system impact (SC:H/SI:H/SA:H) implying a scope change, yet the description only establishes code execution on the host itself - verify whether cross-system impact is truly warranted.

An attacker who has obtained or been granted Joomla administrator credentials logs into the back end, navigates to the Event Manager's administrator source functionality, and uses its file-write capability to save a malicious PHP file (a webshell) into a web-reachable directory. They then request that file over HTTP to execute arbitrary commands as the web server user, achieving full server compromise. With AC:L and no user interaction required, the write-to-execute step is straightforward once admin access exists; no public exploit is currently identified, so an operator would be crafting the payload manually.