CVE-2026-102785
CriticalCVSS 10.0Summary
Joomla extension YOOtheme Pro versions 5.0.0–5.0.52 contains an unauthenticated remote code execution vulnerability. The publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature, allowing an attacker to reuse a signature from a legitimate public image URL, inject additional operations, traverse out of the cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
Risk Assessment
An attacker can write a malicious PNG/PHP polyglot into a public media directory and achieve remote code execution on the Joomla server. This leads to full compromise of the website and server.
Recommendation
Update YOOtheme Pro to a version later than 5.0.52 and review public media directories for unexpected PNG/PHP files.
Other vulnerabilities in YOOtheme Pro
See all- CVE-2026-77997Medium
YOOtheme Pro for Joomla versions 1.0.0-5.0.41 has a missing access check, allowing users with com_template editing permissions to access information about arbitrary modules without the respective com_modules permissions. This is an information disclosure for authenticated, privileged users.
- CVE-2026-77996High
Joomla Extension - yootheme.com - Authenticated, privileged stored XSS in YOOtheme Pro 1.0.0-5.0.41 - Lack of escaping in the location custom field lead to a XSS vector.
- CVE-2026-76613High
YOOtheme Pro for Joomla versions 1.0.0-5.0.40 contains an SQL injection vulnerability that allows any contributor-level user to inject own content into SQL queries.
- CVE-2026-75115High
Joomla Extension - yootheme.com - YOOtheme Pro 2.3.0-5.0.40 has authenticated, privileged arbitrary file read. The Filesystem source's path filter is vulnerable to glob-based pattern attacks, allowing authorized users to read arbitrary files.
Original NVD description (English source)
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS