← Back to search

CVE-2026-102427

10 CRITICAL

Published 2026-09-30 · Updated 2026-10-01

AI risk analysis

Summary
This vulnerability allows unauthenticated attackers to execute arbitrary code on the server by uploading a specially crafted image file with PHP code embedded in the filename and header, leading to remote code execution.
Exploitability
Exploitation is relatively easy as the vulnerability requires no authentication and the attacker can upload a file through the frontend routing of the component.
Blast radius
If exploited, this could result in complete compromise of the server, including data theft, unauthorized access, and potential propagation of the attack to other systems.
Detection
No reliable host or network indicator is derivable from the published description.
Prioritized remediation
Upgrade to OrdaSoft Joomla CCK version 8.3.16 or later.
rcewebunauthphp

Analysis generated locally by qwen2.5:7b-instruct (no data left the box). AI-assisted — verify against primary sources before acting.

NVD description

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Weaknesses

CWE-434

Vendors

ordasoft

Products

joomla cck

All references

Source data: NVD (nvd.nist.gov), public domain. Exploit-DB.ai adds local AI analysis for defensive use only.

Related CVEs

Related by shared AI tags and CWE weakness class. Browse the full archive.