Paper/Archive/CVE-2026-57828

CVE-2026-57828

phoca.cz phoca.cz Phoca Download extension for Joomla — Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3

EPSS 0.5%CVSS 9.0

critical.is priorityof 100

CVSS 9.0 (CNA)9.0 / 10 × 3027.0 Not in CISA KEV+300.0 EPSS percentile 45.6.456 × 209.1 No public exploit+100.0 SSVC exploitation: none+100.0

Description · from the CVE record

Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

Affected

ProductAffectedFixed inSource

phoca.cz Phoca Download extension for Joomla1.0-6.1.2–CNA

Scores by source

Joomla (CNA)9.0CVSS:4.0/AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

CISA ADPSSVCExploitation: none · Automatable: no · Technical impact: total

References

refphoca.cz/phocadownload writeupmysites.guru/blog/phoca-download-authenticated-file-upload-rce