CVE-2026-88857: Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7
Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.
Affected Software
Event History
Frequently Asked Questions
Who can exploit this issue?
An attacker must be authenticated and have the Joomla core.manage permission. This is therefore primarily exposed where privileged Joomla accounts are compromised or granted to untrusted users.
What does exploitation require?
The attacker uploads a PHP file through saveWatermark(), presenting it with an image Content-Type header. Because the uploaded filename is used without sanitisation or validation, the attacker can then request the file from its web-accessible location to execute it.
Are installations affected by default?
The available information does not establish whether the vulnerable functionality or core.manage access is enabled by default. Exploitation depends on an authenticated user holding that permission.
What can be done if updating is not immediately possible?
Restrict core.manage access to fully trusted accounts and review privileged accounts for compromise or unnecessary permissions. Limit or disable access to the affected upload functionality where operationally possible.
How can administrators look for prior exploitation?
Review the web-accessible directory used by saveWatermark() for unexpected PHP files or files with suspicious image-like names, and check web-server logs for requests to such uploaded files. Also review upload activity performed by accounts with core.manage permission.