CVE-2026-48939: Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

Synopsis

An unrestricted file upload vulnerability in the iCagenda extension for Joomla (versions 1.0.0 through 3.9.14 and 4.0.0 through 4.0.7) allows any unauthenticated network attacker to upload a PHP file through the event attachment feature and execute arbitrary code on the server. No authentication, no victim interaction, and no special environmental conditions are required. No fix versions have been published; HarborGuard is tracking the advisory and will make a patched-image rebuild available as soon as upstream ships a release.

HarborGuard Coverage

Exploit Conditions

• Network reachabilityRequired

  The iCagenda file attachment endpoint must be reachable over the network; an attacker sends a crafted multipart upload request directly to the exposed Joomla installation.

• AuthenticationNot required

  No account or session token is needed; the vulnerable file upload feature is accessible to unauthenticated users.

• Victim interactionNot required

  The attack is fully server-side; no user click, page visit, or other victim action is required to trigger code execution.

• Attack complexityDetail

  Exploitation is reliable and condition-free; the CVSS vector carries AC:L and AT:N, meaning no race conditions, memory layout dependencies, or other environmental factors apply.

Blast Radius

• An attacker executes arbitrary PHP code in the context of the web server process, giving full control over the Joomla application.
• All data stored in the Joomla database (user credentials, content, configuration) is readable and exfiltrable.
• An attacker can write, modify, or delete files accessible to the web server, including other extension files and configuration files.
• If the server is part of a broader container environment, the exploit provides an initial foothold for lateral movement into adjacent services and systems.