CVE-2026-88856: Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions updateOSGallery(), reached via task=updateosgallery, read a JSON request body and called the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or iscallable() check of any kind. Any function name compatible with a single argument was directly reachable, including system, exec, shellexec, and passthru.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
Joomla OrdaSoft.com Joomla Gallery extension (updateOSGallery)to a version that resolves this vulnerability.Fixed in 6.2.7
Event History
Frequently Asked Questions
Who can exploit this vulnerability?
An attacker must be authenticated and have privileges sufficient to reach the update_osgallery task. The available data does not establish whether lower-privileged Joomla users can access it.
What does an attacker need to send to trigger code execution?
The vulnerable updateOSGallery() handler is reached through task=update_osgallery and processes a JSON request body. It invokes the method field as a PHP function with the package field supplied as that function's single argument.
Are default installations affected?
The data identifies affected Joomla Gallery extension versions as earlier than 6.2.7, but does not state whether the vulnerable handler is enabled or reachable in a default installation.
How can I determine whether an installation is affected?
Verify whether the OrdaSoft Joomla Gallery extension is installed and whether its version is earlier than 6.2.7. Also review access to task=update_osgallery, since exploitation requires authenticated privileged access.