CVE Catalog
CVE-2026-77991
CriticalCVSS 9.4Summary
The Joomla Event Manager extension versions below 5.0.1 contain a privileged remote code execution vulnerability. The administrator can write dangerous file types including PHP, leading to remote code execution.
Risk Assessment
Risk of full server compromise by an administrator who can execute arbitrary code.
Recommendation
Update the Joomla Event Manager extension to version 5.0.1 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Joomla Extension - joomlaeventmanager.net - Privileged remote code execution in Joomla Event Manager < 5.0.1 - The administrator source model allows to write dangerous file type incl. PHP, leading to remote code execution.