Vulnerability · Published Sep 15, 2026 · Assigned by Joomla
CVE-2026-84048Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2
Medium 6.3
In plain English
A medium-severity improper access control in JoomGallery extension for Joomla from joomgalleryfriends.net. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 43% of all known vulnerabilities).
Official description
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| joomgalleryfriends.net | JoomGallery extension for Joomla | 4.0.0-4.4.1 |
Weakness: CWE-284 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A