Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE

iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges. id: CVE-2026-48939 info: name: Joomla iCagenda 3.9.10 - Unauthenticated Arbitrary File...

By-Poloss..-..CVE-2026-48939

CVE-2026-48939 - iCagenda の認証なしファイルアップロードによる RCE 概要 項目| 値 ---|--- CVE ID| CVE-2026-48939 CVSS 4.0 スコア| 10.0 Critical（重大） CVSS ベクター| CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H CWE| CWE-284: 不適切なアクセス制御 影響を受けるバージョン| iCagenda 3.2.1 - 3.9.14 および 4.0.0 - 4.0.7 修正バージョン| iCagenda 4.0...

CVE-2026-48939_PoC

このリポジトリには README がありません。...

📄 ICagenda 3.9.14 / 4.0.7 Shell Upload

iCagenda, a popular events and calendar component for Joomla, contains an unauthenticated file upload vulnerability that allows remote attackers to upload and execute arbitrary PHP code on Joomla 6 sites. Versions 3.2.1 through 3.9.14 and 4.0.0 through 4.0.7 are affected.:1 CVE-2026-48939 -...