CVE-2026-84048: Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.1
Published Sep 15, 2026
·Updated
Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.1 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.
Affected Software
1 affected component
JoomGallery JoomGallery<4.4.1
Event History
Sep 15, 2026
CVE Published
via MITRE·07:07 PM
Data Sourced
via MITRE·07:07 PM
DescriptionWeakness
Frequently Asked Questions
1
What conditions are required for uploaded files to lead to code execution?
The TUS endpoint permits unauthenticated arbitrary file uploads, but attackers cannot control the uploaded file name or extension. Code execution additionally requires a non-standard server configuration.
2
Are default server configurations likely to permit code execution?
The available information states that code execution requires non-standard server configuration. It does not identify which specific configurations are affected.