CVE-2026-102785: Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.55
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
Affected Software
Event History
Frequently Asked Questions
What does an attacker need to exploit this issue?
The attacker needs access to a legitimate public image URL that exposes a request signature. No authentication is required once such a signature can be reused.
Which deployments are realistically exposed?
Deployments that publicly expose YOOtheme Pro's image transformation handler and serve its generated output from an executable public media directory are exposed. The issue involves reusing signatures from legitimate public image URLs.
How can defenders look for possible compromise?
Inspect the public media and image-cache locations for unexpected PNG files, particularly files outside the intended cache directory or files that may contain PHP content. The described attack writes an attacker-controlled PNG/PHP polyglot after traversing out of the intended cache path.
What version range should be treated as affected?
The supplied data is inconsistent: the title lists versions 5.0.0 through 5.0.55, while the description lists 5.0.0 through 5.0.52. Confirm the applicable fixed version with the vendor before relying on either range.