CVE-2026-102427: Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
OrdaSoft Joomla CCKto a version that resolves this vulnerability.Fixed in 8.3.16
Event History
Frequently Asked Questions
Who is exposed to this issue?
Sites using OrdaSoft Joomla CCK versions earlier than 8.3.16 are exposed if the component's normal frontend routing is reachable. Exploitation does not require authentication or an ACL-approved account.
What does an attacker need to exploit it?
An attacker needs to send a request through the frontend task=getContent route and upload a file with attacker-controlled filename extension. A PHP/image polyglot can satisfy the magic-byte MIME validation while being saved with a .php extension.
Are default file-upload protections sufficient?
No. Although the handler performs a magic-byte MIME check, the extension allow-list is commented out and the uploaded filename's extension is used without validation. The resulting file is written beneath the Joomla web root where the PHP handler can execute it.
How can I determine whether a site may already be affected?
Review files written under the Joomla web root for unexpected PHP files, particularly files that may contain image headers followed by PHP source. Also investigate requests invoking the component's frontend task=getContent route and check whether the installed CCK version is earlier than 8.3.16.