CVE-2026-61900

CriticalCVSS 10.0

Published: 20/07/2026(UTC)Updated: 23/07/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.26%

18th percentile - higher than 18% of all known CVEs

Summary

The Joomla extension JDownloads versions below 4.1.6 contains an unauthenticated arbitrary file upload vulnerability. This allows a remote attacker to upload any file without authentication, leading to full remote code execution (RCE).

Risk Assessment

An attacker can fully compromise the Joomla server, steal data, or install malware without needing any credentials.

Recommendation

Immediately update the JDownloads extension to version 4.1.6 or later. Restrict file upload capabilities to trusted users only.

Original NVD description (English source)

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE.