Paper/Archive/CVE-2026-48906

CVE-2026-48906

tassos.gr Novarain/Tassos Framework (plg_system_nrframework) — Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla

EPSS 0.3%CVSS 9.3

critical.is priorityof 100

CVSS 9.3 (CNA)9.3 / 10 × 3027.9 Not in CISA KEV+300.0 EPSS percentile 18.9.189 × 203.8 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Affected

ProductAffectedFixed inSource

Novarain/Tassos Framework (plg_system_nrframework)1.0.0-6.0.1–CNA

Convert Forms1.0.0-4.4.12–CNA

Convert Forms5.0.0-5.1.5–CNA

EngageBox1.0.0-6.3.11–CNA

EngageBox7.0.0-7.1.1–CNA

Google Structured Data1.0.0-5.6.11–CNA

Google Structured Data6.0.0-6.1.9–CNA

Advanced Custom Fields1.0.0-2.8.12–CNA

Advanced Custom Fields3.0.0-3.1.3–CNA

Smile Pack1.0.0-1.2.6–CNA

Smile Pack2.0.0-2.1.0–CNA

Tassos Code Snippets1.0.0–CNA

Scores by source

Joomla (CNA)9.3CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/AU:Y

CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: partial

References

reftassos.gr