CVE-2026-48939: iCagenda Joomla extension unrestricted file upload leads to PHP RCE

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 17 September 2026. Confidence: high.

critical priorityUnauthenticated network-reachable upload leading to PHP code execution, listed in CISA KEV with a public exploit and a CVSS 4.0 score of 10.

What it is

The iCagenda extension for Joomla fails to restrict file types in its file attachment feature, allowing arbitrary file uploads that result in PHP code upload and execution. Because the flaw is remotely reachable without authentication or user interaction and yields full code execution, it is a critical risk to any exposed Joomla site running the affected extension.

Impact

An attacker can upload and execute arbitrary PHP code on the web server, gaining remote code execution with the privileges of the web server process. This enables full site compromise, data theft, and use of the host as a foothold for further attacks.

Attack surface

The vulnerability is reached over the network through the extension's file attachment upload feature, per the CVSS 4.0 vector AV:N/AC:L/PR:N/UI:N, meaning no authentication and no user interaction are required. Any internet-exposed Joomla site with the vulnerable iCagenda extension is directly reachable.

Exploitation

CVE-2026-48939 is listed in CISA's Known Exploited Vulnerabilities catalog (added 2026-07-10, due 2026-07-13), and a public exploit reference exists, indicating active exploitation. EPSS gives a 30-day exploitation probability of about 20% (97th percentile), and no ransomware campaign use is documented.

What to do

• Apply the vendor fix by upgrading iCagenda to the patched releases referenced in the changelog (3.9.15 or 4.0.8) as soon as possible.
• If patching is not immediately possible, disable or remove the iCagenda file attachment feature, or take the extension/site offline until mitigations are available, per CISA BOD 26-04 guidance.
• Restrict upload directories so they cannot execute PHP (disable script execution in the Joomla upload/tmp paths via web server configuration).
• Enforce strict file type and extension allowlisting on all upload endpoints, and validate uploads server-side rather than relying on client checks.
• Review internet exposure of all Joomla instances running iCagenda and prioritize those directly reachable from the internet.
• Follow CISA's Forensics Triage Requirements for any asset that may have been exposed before patching.

Detection

• Monitor web server and Joomla logs for POST requests to iCagenda attachment/upload endpoints followed by requests to newly written files in upload directories.
• Alert on creation of PHP files in Joomla upload, tmp, or media directories, especially files with unusual names or extensions.
• Hunt for outbound connections or child processes spawned by the web server user (php-fpm/apache) that indicate webshell execution.
• Check for unexpected or modified files in the Joomla installation and compare against known-good baselines.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.