OrdaSoft Joomla Gallery EUVD-2026-83768

Requires an authenticated Joomla backend account holding the core.manage permission on the OrdaSoft Joomla Gallery extension (free or paid, versions < 6.2.7), and the ability to reach the watermark-upload function. The attacker uploads a .php file with a spoofed image Content-Type; no extension, content, or filename validation is performed, and the file lands in a web-accessible directory that can be requested directly. Limiting factors: exploitation is gated on that privileged (though not Super Admin) authenticated role, so it is not exploitable by anonymous visitors; it also requires the vulnerable extension to be installed and the uploaded path to remain web-reachable (no .htaccess/upload-dir hardening).

This is a genuinely high-priority vulnerability: arbitrary file upload leading to remote code execution (CWE-434) is one of the most reliably weaponizable bug classes. The vendor's CVSS 4.0 vector (9.4, AV:N/AC:L/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H) captures full technical impact, and the description is unambiguous - no extension check, no content check, no filename sanitisation, plus a directly requestable web path, meaning exploitation is deterministic once access is obtained. The main dampener is the privilege requirement: it needs an authenticated Joomla user holding the core.manage permission on the gallery component, so this is not an unauthenticated internet-facing bug. I assess PR:L rather than the vendor's PR:H because core.manage is a manager/editor-scoped ACL action, not full Super Admin, which actually makes the real-world attack surface slightly WIDER than the vendor score implies (a lower-trust backend account suffices). Countering the raw 9.4: no EPSS score, no CISA KEV listing, and no public POC were provided, and the affected product is a niche third-party Joomla extension, so widespread automated exploitation is unlikely - this is a serious flaw in a low-footprint product, best triaged as a must-patch for the sites that run it rather than an internet-wide emergency.

An attacker who has (or phishes/registers into) a Joomla backend account with core.manage rights on the OrdaSoft Gallery component uploads a PHP webshell through the watermark-upload feature, setting an image Content-Type header while keeping the .php filename. Because saveWatermark() writes the file verbatim into a web-accessible directory, the attacker then simply requests the resulting URL to execute the shell and gain code execution on the server. No public exploit was identified at time of analysis, but the technique is trivial and well understood.