Acymailing Enterprise Extension For Joomla
Monthly
Unauthenticated remote code execution in AcyMailing Enterprise for Joomla (versions before 11.1.0) lets anyone who can email the address monitored by the extension's 'mailbox action' feature write a PHP file into the site's web root, because inbound MIME parts are stored under media/com_acym/upload/ with no extension check (CWE-434); once reachable over HTTP and PHP-executable, that file runs as the web-server account. The gating precondition is that mailbox monitoring is enabled and the upload path is web-exposed, which is not a default configuration, but where it applies exploitation is trivial and requires no authentication (CVSS 4.0 9.5 with AT:P; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with the scope change reflecting impact escaping the extension into the hosting Joomla site). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor-released fix is AcyMailing Enterprise 11.1.0.
Unauthenticated remote code execution in AcyMailing Enterprise for Joomla (versions before 11.1.0) lets anyone who can email the address monitored by the extension's 'mailbox action' feature write a PHP file into the site's web root, because inbound MIME parts are stored under media/com_acym/upload/ with no extension check (CWE-434); once reachable over HTTP and PHP-executable, that file runs as the web-server account. The gating precondition is that mailbox monitoring is enabled and the upload path is web-exposed, which is not a default configuration, but where it applies exploitation is trivial and requires no authentication (CVSS 4.0 9.5 with AT:P; independent assessment CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:H, with the scope change reflecting impact escaping the extension into the hosting Joomla site). No public exploit code and no confirmed active exploitation (CISA KEV) were identified at time of analysis; the vendor-released fix is AcyMailing Enterprise 11.1.0.