CVE-2026-105606: Malicious File Upload
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.
Event History
Frequently Asked Questions
Which sites are exposed to exploitation?
Joomla sites using Custom Tables versions earlier than 3.7.8 are exposed if they provide a public Custom Tables submission form. No authentication is required for an attacker to use the vulnerable upload path.
What does an attacker need to do to exploit this issue?
The attacker needs network access to a site with an exposed public submission form. They can upload a polyglot file with an attacker-controlled extension, and the response discloses the path where the file was stored.
What is the practical impact of the uploaded file?
The file is written to a web-accessible tmp directory and is served as static content by default. An attacker can use the victim domain to host attacker-controlled content, such as phishing or malware pages.