CVE-2026-105603

CriticalCVSS 9.4

Published: 02/11/2026(UTC)Updated: 02/11/2026(UTC)Translated: 02/11/2026(UTC)NVD NIST

Summary

The Joomla DJ-Classifieds extension before 3.11.3 is vulnerable to an unprivileged file upload, leading to full remote code execution (RCE).

Risk Assessment

A low-privileged attacker can take control of the server by executing arbitrary code, posing a critical threat to confidentiality, integrity, and availability.

Recommendation

Immediately update DJ-Classifieds to version 3.11.3 or later and verify that no unauthorized file uploads have occurred.

Other vulnerabilities in Joomla DJ-Classifieds

CVE-2026-105604Critical
The Joomla DJ-Classifieds extension before 3.11.3 is vulnerable to an unauthenticated SQL injection in the frontend search.

Original NVD description (English source)

Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS