PT-2026-57426 · Phoca.Cz · Phoca.Cz Phoca Download Extension For Joomla

Phil Taylor · Published 2026-07-11 · Updated 2026-07-11 · CVE-2026-57828

Mitre

CVSS v4.0

9.0

Critical

Base vector

AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

Fix

Unrestricted File Upload

Weakness Enumeration

CWE-434

Related Identifiers

CVE-2026-57828

Affected Products

Phoca.Cz Phoca Download Extension For Joomla

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2026-57828 · Security Note
• https://twitter.com/UpwindMDR/status/2075897713749565806 · Twitter Post
• https://phoca.cz/phocadownload · Note
• https://mysites.guru/blog/phoca-download-authenticated-file-upload-rce · Note