CVE-2026-60032
CriticalCVSS 9.4Exploitation Probability (EPSS)
Low risk15th percentile - higher than 15% of all known CVEs
Summary
The Joomla extension JMedia versions below 1.6.0 is vulnerable to authenticated arbitrary file upload. An authenticated attacker can upload executable files (including with polyglot filenames), and chmod does not strip execute bits, leading to remote code execution (RCE).
Risk Assessment
An attacker with a user account can upload a malicious file and execute it on the server, enabling control over the Joomla site and access to data.
Recommendation
Update the JMedia extension to version 1.6.0 or later. Implement strict file type validation and remove execute bits from uploaded files.
Original NVD description (English source)
Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits.