PT-2026-57426 · Phoca.Cz · Phoca.Cz Phoca Download Extension For Joomla

Phil Taylor · Publicado 2026-07-11 · Atualizado 2026-07-11 · CVE-2026-57828

Mitre

CVSS v4.0

9.0

Crítica

Vetor base

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

Correção

Unrestricted File Upload

Enumeração de Fraquezas

CWE-434

Identificadores relacionados

CVE-2026-57828

Produtos afetados

Phoca.Cz Phoca Download Extension For Joomla

Referências · 4

• https://twitter.com/UpwindMDR/status/2075897713749565806 · Publicação no Twitter
• https://nvd.nist.gov/vuln/detail/CVE-2026-57828 · Nota de Segurança
• https://phoca.cz/phocadownload · Nota
• https://mysites.guru/blog/phoca-download-authenticated-file-upload-rce · Nota