Event Gallery EUVD-2026-87930

Requires an authenticated Event Gallery for Joomla user (with image-upload rights) to be logged in with an active session, and that user must be tricked into loading an attacker-controlled page in the same browser (victim interaction). The image-upload endpoint must lack a CSRF token check, which is the vulnerable default in versions below 6.5.0. Overwrite impact is limited to files sharing the same filename as existing event images. Limiting factors: no attacker authentication is needed, but the attack fails without a concurrently authenticated victim who follows the malicious link, and impact is confined to file integrity within event galleries - no data theft, no code execution.

This is a genuinely low-to-moderate real-world risk despite the medium CVSS. The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N, 5.1) reflects a CSRF whose only technical impact is limited integrity (VI:L) - uploading files to an event and overwriting same-name files - with no confidentiality (VC:N) or availability (VA:N) impact. Two signals to reconcile: (1) the vendor marks PR:H and UI:N, which is inconsistent with the CSRF class - a CSRF attacker holds no privileges and inherently requires the victim to perform an action, so PR:N/UI:R (3.1) is the more defensible modeling; the vendor's PR:H appears to encode the privilege of the abused victim account rather than the attacker. (2) There is no EPSS score, no CISA KEV listing, and no public exploit code, so exploitation status is 'no public exploit identified at time of analysis.' The single reference is the vendor homepage (no advisory URL, no changelog, no patch commit), which weakens independent verification. Net: a real but bounded issue best handled via normal patching to 6.5.0, not an emergency - the combination of niche product, low prevalence, integrity-only impact, and required victim interaction places it well below high-priority thresholds.

An attacker lures a currently-logged-in Event Gallery user (e.g. a site editor/admin) to a malicious web page, which auto-submits a cross-origin form to the extension's image-upload endpoint; because no anti-CSRF token is validated, the request is accepted using the victim's session cookies. The attacker uploads attacker-chosen files to an event and can overwrite existing images that share a filename, defacing or corrupting gallery content. No public proof-of-concept exists at time of analysis.