CVE-2026-94131: Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
AcyMailing Enterpriseto a version that resolves this vulnerability.Fixed in 11.1.0
Event History
Frequently Asked Questions
Who can exploit this issue?
A subscriber can exploit it by storing a file path in a file-type custom field and then clearing that field. The issue is described as unauthenticated, so no authenticated administrative access is indicated.
What systems and configurations are exposed?
AcyMailing Enterprise versions earlier than 11.1.0 are affected. Exposure requires use of a file-type custom field that a subscriber can populate and later clear.
What can an attacker delete?
The attacker may cause deletion of files referenced by the stored path, including files outside the upload directory. The description specifically identifies configuration.php as an example.
What should be done if upgrading is not immediately possible?
The provided information supports limiting or disabling subscriber access to file-type custom fields, particularly the ability to clear values in those fields. Review such fields for path values that reference files outside the intended upload folder.