CVE-2026-94132: Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/comacym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed to exploitation?
AcyMailing Enterprise deployments below 11.1.0 are exposed if they use the mailbox action feature with a monitored mailbox that an attacker can send email to.
What access does an attacker need?
The attacker needs the ability to email the monitored mailbox. No other access requirement is stated.
How can administrators check for possible exploitation?
Inspect media/com_acym/upload/ for unexpected PHP files or other files created from incoming email MIME parts. Review the monitored mailbox for suspicious messages that may have carried such attachments.
What can be done if upgrading is not immediately possible?
Restrict who can send messages to the monitored mailbox, or disable the mailbox action feature if it is not required. Upgrading AcyMailing Enterprise to 11.1.0 or later removes the affected version range.