CVE-2026-84048: Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
JoomGallery (joomgalleryfriends.net)to a version that resolves this vulnerability.Fixed in 4.4.2
Event History
Frequently Asked Questions
What conditions are required for uploaded files to lead to code execution?
The TUS endpoint permits unauthenticated arbitrary file uploads, but attackers cannot control the uploaded file name or extension. Code execution additionally requires a non-standard server configuration.
Are default server configurations likely to permit code execution?
The available information states that code execution requires non-standard server configuration. It does not identify which specific configurations are affected.