CVE-2026-84048
MediumCVSS 6.3Summary
Joomla Extension JoomGallery prior to 4.4.1 contains unauthenticated arbitrary file upload via the TUS endpoint. However, neither file name nor file extension are under attacker control, and code execution requires non-standard server configuration.
Risk Assessment
Despite limitations, the vulnerability may allow uploading malicious files if the server has non-standard configuration. This could lead to website compromise.
Recommendation
Update JoomGallery to version 4.4.1 or later and verify server configuration for non-standard settings.
Other vulnerabilities in JoomGallery
See all- CVE-2026-66917High
Joomla Extension - joomgalleryfriends.net - Stored XSS in JoomGallery < 4.4.0 - An authenticated, privileged can store an XSS payload in any image causing JS execution in every visitor's browser.
- CVE-2026-66916Medium
Joomla Extension - joomgalleryfriends.net - Password-Protected Category Bypass via JSON Format in JoomGallery < 4.4.0- An unauthenticated access control bypass exists in JoomGallery's category JSON view. When a gallery category is protected with a password, the HTML view correctly enforces the password gate - but the JSON view ( format=json ) skips this check entirely.
Original NVD description (English source)
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.1 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.