Vulnerability · Published Sep 26, 2026 · Assigned by Joomla

CVE-2026-94132Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Critical 9.5

In plain English

A critical-severity unrestricted file upload in AcyMailing Enterprise extension for Joomla from acymailing.com. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 41% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code.

Severity (CVSS 4.0)9.5Critical

Exploit odds (30 days)0.5%top 59.1% of all CVEs

Exploited in the wildNo reportsCISA SSVC: none

Attack tooling1Public PoC

Official description

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root.

Affected products (as reported)

Vendor	Product	Versions
acymailing.com	AcyMailing Enterprise extension for Joomla	6.0.0-11.0.5

Weakness: CWE-434 · Vector: CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

References

https://www.acymailing.com/ product