Vulnerability · Published Mar 5, 2026 · Assigned by Joomla
CVE-2026-21628Extension - astroidframe.work - Unauthenticated Remote Code Execution in Astroid Framework 2.0.0 - 3.3.10 for Joomla
Critical 10.0
In plain English
A critical-severity unrestricted file upload in Astroid Template Framework from astroidframe.work. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 46% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.
Severity (CVSS 4.0)10.0Critical
Exploit odds (30 days)0.5%top 54.3% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC
Official description
A improperly secured file management feature allows uploads of dangerous data types for unauthenticated users, leading to remote code execution.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| astroidframe.work | Astroid Template Framework | 2.0.0-3.3.10 |
Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y
References
- https://astroidframe.work product