CVE-2026-117551: Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8
Published Nov 12, 2026
·Updated
Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution.
Event History
Nov 12, 2026
CVE Published
via MITRE·05:58 PM
Data Sourced
via MITRE·05:58 PM
DescriptionWeakness
Data Sourced
via NVD·06:17 PM
DescriptionSeverityWeakness
Frequently Asked Questions
1
Who can exploit this issue?
A user who has permission to upload frontend thumbnails can exploit it. The vulnerability allows that user to upload an executable file and achieve PHP code execution on the server.
2
What versions are affected?
jDownloads versions earlier than 4.1.8 are affected.