CVE-2026-48939 - PatchNow

📋 Vulnerability Details

Data Source: CIRCL

Confidence: HIGH

Exploitation Method: DIRECT_NETWORK

CVE Published: 2026-06-20

Added to CISA KEV: 2026-07-10 20 DAYS BETWEEN CVE AND KEV

🎯 Recommendations:

CRITICAL: Check for indicators of compromise - this vulnerability is in CISA KEV indicating active exploitation in the wild. Review web server logs for suspicious file uploads/POSTs to the iCagenda attachment endpoint, scan the web root for unexpected PHP files/web shells, and verify system and database integrity.
Immediately update the iCagenda extension to version 3.9.15 or 4.0.8 (or later). If patching is not immediately possible, disable the file attachment feature in the iCagenda configuration or restrict/remove the component entirely.
Monitor for post-exploitation activity: new administrator accounts, outbound connections, scheduled tasks/cron modifications, and lateral movement from the compromised web server. Deploy WAF rules to block arbitrary file uploads to the attachment endpoint.
Patch priority: EMERGENCY / IMMEDIATE — CVSS 10.0, unauthenticated RCE, active exploitation, public PoC. Meets CISA KEV remediation urgency.

🔍 Web Intelligence (Kagi · 2026-09-14)

Summary

CVE-2026-48939 is a critical vulnerability (CVSS 10.0) in the iCagenda events calendar extension for Joomla that stems from inadequate server-side validation and missing authorization checks within its file attachment feature ^[2]^[3]. By failing to restrict file types or enforce proper access controls at the controller level, the extension allows unauthenticated attackers to upload arbitrary files—including malicious PHP scripts—directly to the web root, which can subsequently be executed to achieve full remote code execution (RCE) on the underlying server ^[1]^[2].

Exploitation

Active Exploitation: The vulnerability has been exploited in the wild, leading the U.S. Cybersecurity and Infrastructure Security Agency (CISA) to add it to its list of known exploited vulnerabilities ^[5].
Threat Actors: While specific advanced persistent threat (APT) groups have not been widely publicized by name, the exploit has been utilized in campaigns targeting internet-facing Joomla installations for server compromise ^[1].
Availability: Proof-of-concept (PoC) exploit code is publicly available, including repositories on platforms like GitHub that detail the mechanics of the unauthenticated upload ^[2].
Attack Prerequisites: This is a network-based attack that requires no authentication and no specific user interaction; attackers can trigger the flaw remotely by interacting with the frontend event registration form's file attachment feature ^[1]^[2].

Affected Products & Patches

Affected Versions: All versions of the iCagenda extension for Joomla prior to the security patch release are considered vulnerable ^[6].
Patch Availability: Users are urged to update to the latest version of the iCagenda extension provided by the vendor, which includes necessary server-side validation and access control fixes.
Mitigations/Workarounds: If an immediate update is not possible, administrators should disable the file attachment feature in the iCagenda configuration or restrict access to the component entirely to prevent exploitation ^[4].

Impact

Access and Capabilities: Successful exploitation grants attackers the ability to upload and execute arbitrary PHP code, providing them with full remote control over the Joomla application and the underlying web server ^[3]^[7].
Business Risk: For internet-facing deployments, this vulnerability poses a critical risk of complete system compromise, including unauthorized access to sensitive database information, site defacement, the deployment of ransomware, or the use of the server as a pivot point for further lateral movement within the internal network ^[1]^[3].

Sources

Joomla Multiple Extensions File Upload RCE - CVE-2026- ...
For example, CVE-2026-48907 in the widely used Joomla Content Editor (JCE) plugin allow unauthenticated actors to generate malicious editor ... These five critical vulnerabilities, CVE-2026-56291 (Balbooa Forms), CVE-2026-56290 (Page Builder CK), CVE-2026-48908 (SP Page Builder), CVE-2026-48939 (iCa…
CVE-2026-48939 — iCagenda Joomla RCE Exploit - GitHub
CVE-2026-48939 is a CVSS 10.0 critical vulnerability in the iCagenda events calendar extension for Joomla. The frontend event registration form's file attachment feature enforces access controls only at the view layer — not the controller — allowing unauthenticated file upload with no extension vali…
CVE-2026-48939: CVE-2026-48939: Unauthenticated Remote Code Execution ...
CVE-2026-48939 is a critical vulnerability in the iCagenda events calendar extension for Joomla that allows unauthenticated remote attackers to execute arbitrary code via unrestricted file uploads. The flaw stems from a lack of server-side validation of file uploads and missing authorization checks…
Zero Day Vulnerability Found in iCagenda Joomla Extension
mySites.guru found and confirmed an unauthenticated upload giving remote code execution on Joomla 6 sites running iCagenda.
iCagenda and Balbooa Forms Joomla Flaws Reportedly ...
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added two maximum-severity security flaws impacting iCagenda and ...

🔴 CVE-2026-48939