Log in Start free

Vulnerability · Published Sep 20, 2026 · Assigned by Joomla

CVE-2026-88856Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7

Critical 9.4

In plain English

A critical-severity code injection in OrdaSoft Joomla Gallery extension for Joomla from OrdaSoft.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.7% (higher than 52% of all known vulnerabilities).

Severity (CVSS 4.0)9.4Critical
Exploit odds (30 days)0.7%top 48.0% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions updateOSGallery(), reached via task=update_osgallery, read a JSON request body and called the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check of any kind. Any function name compatible with a single argument was directly reachable, including system, exec, shell_exec, and passthru.

Affected products (as reported)

VendorProductVersions
OrdaSoft.com OrdaSoft Joomla Gallery free extension for Joomla 1.0.0-6.2.6
OrdaSoft.com OrdaSoft Joomla Gallery extension for Joomla 1.0.0-6.2.6

Weakness: CWE-94 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References