CVE-2026-117550: Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8
Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 - Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy.
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
jdownloads.comto a version that resolves this vulnerability.Fixed in 4.1.8
Event History
Frequently Asked Questions
What conditions are required for exploitation?
An attacker needs to be able to submit content through the jDownloads frontend and manipulate submission parameters. The issue affects the publication and ownership checks applied to those frontend submissions.
Are sites with automatic publication disabled still affected?
Yes. Manipulated frontend submission parameters could cause submissions to be published even when automatic publication is disabled.
What should administrators review to identify possible impact?
Review files submitted through the frontend for unexpected publication status and for ownership assignments that do not match the intended policy. Pay particular attention to submissions made while automatic publication was disabled.