CVE-2026-48939: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Other sources
iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
— CISA
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla Extension - iCagendato a version that resolves this vulnerability.Fixed in 4.0.8 - Upgrade
Upgrade
Joomla Extension - iCagendato a version that resolves this vulnerability.Fixed in 3.9.15 - Compensating control
Evaluate each asset’s internet exposure and ensure adherence to CISA BOD 26-04 patching guidance; if mitigations are unavailable for cloud services, discontinue use of the product.
Event History
Frequently Asked Questions
What is the severity of CVE-2026-48939?
The severity of CVE-2026-48939 is rated as critical with a CVSS score of 10.
How do I fix CVE-2026-48939?
To fix CVE-2026-48939, update the iCagenda extension to the latest version, which is at least 4.0.8 or 3.9.15.
What type of vulnerability is CVE-2026-48939?
CVE-2026-48939 is classified as a Remote Code Execution vulnerability.
What impact does CVE-2026-48939 have on users?
CVE-2026-48939 allows an attacker to upload arbitrary files, potentially leading to unauthorized PHP code execution.
Which Joomla versions are affected by CVE-2026-48939?
CVE-2026-48939 affects iCagenda extension versions prior to 4.0.8 and 3.9.15.