EUVD-2026-89995
GHSA-v3vp-7jrj-hc66
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain
-
AccessReach frontend uploader via task=getContent
-
DeliveryUpload image/PHP polyglot with .php name
-
ExploitBypass MIME magic-byte check
-
ExecutionFile written under web root
-
PersistRequest uploaded file
-
ImpactExecute arbitrary PHP as web user
Vulnerability Assessment
| Weakness |
CWE
OWASP Top 10:2025
A06:2025 - Insecure Design
ASVS 5.0
V5 - File Handling File type validation, storage isolation
MITRE ATT&CK
2 techniques across 2 tactics: Command and Control, Persistence The technique list with ATT&CK links and the kill-chain view is part of the Basic plan and up. |
| Exploitation Conditions | Exploitation requires only that the OrdaSoft Joomla CCK component (version < 8.3.16) be installed and its frontend reachable - the vulnerable site/uploader.php is exposed through normal frontend routing at task=getContent with no authentication or ACL check anywhere in the dispatch chain, matching AV:N/PR:N/UI:N. The uploader enforces a magic-byte MIME check but the extension allow-list is commented out in the shipped source, so an image/PHP polyglot with an attacker-chosen .php extension passes validation and is written to an executable path under the Joomla web root. The only meaningful limiting factor is deployment scope: the target must run this specific commercial extension below 8.3.16; there is no user-interaction, no privilege, and no non-default-configuration requirement. |
| Impact | This is a genuine top-tier priority, not an inflated high-CVSS score. The CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N with VC:H/VI:H/VA:H and SC:H/SI:H/SA:H) describes an unauthenticated, network-reachable, no-user-interaction remote code execution flaw with full impact on both the vulnerable component and the subsequent system - consistent with the CWE-434 unrestricted-file-upload-to-webshell pattern the description details. The technical narrative reinforces the score: the vulnerable task=getContent route reaches site/uploader.php with no authentication or ACL check, the extension allow-list was commented out in source, and the attacker fully controls the saved extension, allowing a PHP-in-image polyglot to be written under the web root and executed. The CVSS 4.0 threat metrics carry E:A (Attacked) and AU:Y (Automatable: Yes), meaning the vendor/analyst asserts exploitation maturity and that the attack can be reliably scripted - a strong reliability signal even though no CISA KEV entry and no standalone POC link were supplied in this input. No EPSS probability was provided. The main mitigating factor against widespread impact is prevalence: this is a specific commercial Joomla extension (OrdaSoft CCK), not core Joomla, so exposure is bounded by how many sites run this particular component. Net: treat as critical wherever the OrdaSoft CCK component is installed and internet-facing. |
| Exploit ScenarioDerived | An unauthenticated attacker crafts an image/PHP polyglot - valid header bytes that satisfy the magic-byte MIME check with PHP source appended - and names it with a .php extension. They POST it to the component's frontend uploader via task=getContent, which requires no login or ACL check, and the file lands in an executable path under the Joomla web root. Requesting that uploaded URL executes the attacker's PHP as the web server user, yielding full remote code execution; the vector's Automatable:Yes and Attacked flags indicate this is reliably scriptable. |
Get an e-mail when this CVE is exploited, patched or re-scored. Free account.
Alert meAnalysisAIv1 – Sep 30, 2026
Unauthenticated remote code execution in OrdaSoft Joomla CCK (all versions below 8.3.16) lets any remote attacker who can reach the component's frontend upload and execute arbitrary PHP, resulting in full compromise of the Joomla site - the CVSS 4.0 base score is 10.0 and the independent CVSS 3.1 assessment is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. The upload endpoint site/uploader.php is reachable through the component's normal frontend routing via task=getContent with no authentication or ACL check anywhere in the dispatch chain, and the shipped source has its file-extension allow-list commented out, so an image/PHP polyglot carrying an attacker-chosen .php extension passes the magic-byte MIME check and is written to an executable path under the Joomla web root. Exploitation requires no privileges, no user interaction, and no non-default configuration - only that the extension be installed and its frontend be web-reachable; the supplied CVSS v4.0 vector carries E:A (Exploit Maturity: Attacked), although no CISA KEV entry was supplied in the available intelligence, so that metric is the sole exploitation signal available here.
RemediationAI
Vendor-released patch: upgrade OrdaSoft Joomla CCK to 8.3.16, the first version at or above the '< 8.3.16' affected boundary, obtained through the vendor at https://www.ordasoft.com/; because the vulnerable file is a frontend-reachable component endpoint, this update should be treated as urgent rather than scheduled. If the extension cannot be updated immediately, remove or unpublish it, or at minimum block requests to site/uploader.php - including those carrying task=getContent - at the web server, reverse proxy, or WAF, accepting the trade-off that this breaks the component's legitimate upload functionality; separately, disable PHP execution in the directory the uploader writes to via the web server configuration so that any dropped file is served as inert data rather than executed. After remediation, treat the site as potentially compromised: inspect the uploader's target directory and the Joomla web root for unexpected .php files and image/PHP polyglots, review recently created or modified files, and check server logs for POST requests to site/uploader.php or task=getContent. Note that the file-extension allow-list is commented out in the shipped source, so re-enabling that check is a developer-side workaround only and does not substitute for the patched release.
Affected VersionsENISA
Affected Packages
Source: OSV (Open Source Vulnerabilities)
Affects your stack
Affects 1 package in euvd
Checking this CVE against your own stacks and servers is part of the Basic plan and up.
Technical ContextAI · show details
The root cause is CWE-434, unrestricted upload of a file with a dangerous type, arising from a partially implemented validation routine in OrdaSoft's Joomla CCK component. The uploader does perform a genuine content-based, magic-byte MIME inspection, so a bare PHP payload is rejected; however, the second half of the defence - the extension allow-list that would have constrained the suffix of the saved filename - is present in the shipped source and commented out. The saved extension is therefore taken verbatim from the attacker-supplied filename, and the file is written to a path directly beneath the Joomla web root that the PHP handler will execute. By crafting an image/PHP polyglot - a file whose leading bytes satisfy the MIME check, with PHP source appended after the image header - an attacker satisfies the content check while retaining a .php extension of their choosing. The endpoint site/uploader.php is reached through the component's normal frontend routing (task=getContent), and the dispatch chain contains no authentication or ACL verification, exposing the vulnerable code path pre-authentication to any network client that can reach the site. The CPE cpe:2.3:a:ordasoft.com:ordasoft_joomla_cck:*:*:*:*:*:*:*:* marks the entire version range as affected, and the assessed CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) reflects a scope-changing, fully pre-authentication compromise of confidentiality, integrity, and availability.
Know when Ordasoft Joomla Cck gets its next vulnerability
- Watch products and get an email when something new is published
- Check this CVE against your own stack and servers
- Exploit and PoC references, threat intelligence from 22 sources
No credit card · 7-day full trial
Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y
Unauthenticated network-reachable upload (PR:N/AV:N/UI:N) with no special config; webshell escapes the vulnerable component to compromise the host, so S:C with full C/I/A:H.
Primary rating from Vendor (Joomla).
CVSS VectorVendor: Joomla
DescriptionCVE.org
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.
Executive ViewAI
OrdaSoft's Joomla CCK extension (all versions below 8.3.16) allows any external attacker who can reach a Joomla site's frontend to upload and run their own code on the web server, giving them full control of the site, its database, and any data or credentials it holds - with no login, no user action, and no non-default configuration required. Because no vendor fix has been confirmed, every organization running this component on an internet-reachable Joomla site should assume full site compromise is possible and act on containment immediately rather than waiting for a patch. The supplied CVSS 4.0 vector rates exploit maturity as 'Attacked' (E:A), and the unauthenticated nature of the flaw means perimeter protections alone are unlikely to be sufficient.
No vendor-released patch identified at time of analysis. Interim mitigations: uninstall or disable the OrdaSoft Joomla CCK component; if it must stay, deny external access to site/uploader.php and to task=getContent requests at the WAF/reverse proxy and restrict the component to trusted source IPs; disable PHP execution in upload/media/tmp/cache directories and set them read-only; remove or block the frontend upload route; hunt for and remove dropped webshells, restore from known-good backups, and rotate all site, database and hosting credentials; enable file-integrity monitoring and alerting on new .php files under the web root.
Threat Intelligence Overview
NVD
CVE.org
EPSS
Vulnrichment
How this decision was reached
The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.
What every action level means
SSVC AssessmentENISA
Priority Score
Attack Technique
Malicious file upload attacks exploit insufficient validation when web applications accept user-provided files.
Remote Code Execution represents the critical moment when an attacker successfully runs arbitrary code on a target system without physical access.
Exploit-DB