CVE-2026-74803: Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
Affected Software
Event History
Frequently Asked Questions
Which deployments are affected?
Zoo versions earlier than 4.1.64 are affected. The issue is in the image element's handling of uploaded files.
What does an attacker need to exploit this issue?
An attacker can upload an arbitrary file by supplying a client-controlled Content-Type that is in the image MIME group. The provided information describes the issue as unauthenticated, so authentication is not required.
How can I determine whether my site is exposed?
Check the installed Zoo version. Instances running a version earlier than 4.1.64 should be treated as affected.
What should be done if the installed version is affected?
Update Zoo to version 4.1.64 or later. The provided information does not specify an alternative mitigation for systems that cannot be updated immediately.