CVE-2026-88857
CriticalCVSS 9.4Summary
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The saveWatermark() function copies an uploaded file to a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, content check, or filename sanitization. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.
Risk Assessment
An authenticated user with limited privileges could gain full control over the server by executing malicious PHP code, potentially leading to site and data compromise.
Recommendation
Immediately update the OrdaSoft Joomla Gallery extension to version 6.2.7 or later, which includes the fix. Additionally, restrict core.manage permissions to trusted users only.
Other vulnerabilities in OrdaSoft Joomla Gallery
See all- CVE-2026-88855High
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged SQL injection vulnerability was found. The saveGallery() function passes form data through a hand-rolled parser into Joomla's Input object, then reads it back with ARRAY/STRING filter types, neither of which sanitizes SQL content. Values from category_names[], catOrderIds, and image-ordering fields are concatenated directly into SQL with no quoting or integer cast, giving an authenticated core.manage user full read/write access to the database, including UNION-based extraction of #__users password hashes.
- CVE-2026-88856Critical
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an authenticated privileged remote code execution vulnerability was found. The updateOSGallery() function, reached via task=update_osgallery, reads a JSON request body and calls the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check. Any function name compatible with a single argument is directly reachable, including system, exec, shell_exec, and passthru.
- CVE-2026-88854Critical
In the OrdaSoft Joomla Gallery extension for Joomla versions below 6.2.7, an unauthenticated SQL injection vulnerability was found. The showSearchResult() and showSearchResultAjax() functions read the textsearch/searchText request parameter with $input->getVar(), which is not a real Joomla filter method and only strips HTML tags but does not touch quotes or SQL syntax. The value is concatenated directly into a LIKE clause with no escaping. The endpoint requires no login, and the search module is public.
Original NVD description (English source)
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.