Acymailing Extension For Joomla
Monthly
Unauthenticated arbitrary file deletion in the AcyMailing Enterprise extension for Joomla (versions before 11.1.0) allows a remote attacker to store an arbitrary filesystem path - including paths that traverse outside the configured upload directory, such as configuration.php - in a file-type custom field and have the extension delete that file when the field is subsequently cleared. Exploitation requires a publicly reachable subscription or profile form that has a file-type custom field configured, so a default installation without such a field is not affected; the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) confirms network reachability, low complexity, no privileges required and no user interaction, with high integrity and availability impact but no confidentiality impact, reflecting a purely destructive outcome rather than data theft. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released a fixed version.
Unauthenticated arbitrary file deletion in the AcyMailing Enterprise extension for Joomla (versions before 11.1.0) allows a remote attacker to store an arbitrary filesystem path - including paths that traverse outside the configured upload directory, such as configuration.php - in a file-type custom field and have the extension delete that file when the field is subsequently cleared. Exploitation requires a publicly reachable subscription or profile form that has a file-type custom field configured, so a default installation without such a field is not affected; the CVSS 4.0 vector (CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H) confirms network reachability, low complexity, no privileges required and no user interaction, with high integrity and availability impact but no confidentiality impact, reflecting a purely destructive outcome rather than data theft. No public exploit code and no confirmed active exploitation were identified at time of analysis; the vendor has released a fixed version.