CVE-2026-61900

CriticalCVSS 10.0

Published: 20/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

38th percentile - higher than 38% of all known CVEs

Summary

The Joomla extension JDownloads versions below 4.1.6 contains an unauthenticated arbitrary file upload vulnerability. This allows a remote attacker to upload any file without authentication, leading to full remote code execution (RCE).

Risk Assessment

An attacker can fully compromise the Joomla server, steal data, or install malware without needing any credentials.

Recommendation

Immediately update the JDownloads extension to version 4.1.6 or later. Restrict file upload capabilities to trusted users only.

Other vulnerabilities in JDownloads

CVE-2025-55758Medium
Multiple CSRF attack vectors in JDownloads component 1.0.0-4.0.47 for Joomla were discovered.

Original NVD description (English source)

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS