CVE-2026-60032
The Joomla JMedia extension (versions prior to 1.6.0) contains an authenticated arbitrary file upload vulnerability that allows attackers with valid credentials to upload executable files, potentially leading to remote code execution. The issue arises because the extension does not properly validate uploaded files and fails to strip execute bits, enabling polyglot filenames. No official fix is documented in the provided sources.
No official fix yet. If none appears within 45 days of first tracking, this entry is removed automatically.
Who is affected
Joomla sites using the JMedia extension from themexpert.com, version < 1.6.0
Real-world impact
An attacker who can authenticate to the Joomla admin interface could upload and execute arbitrary code on the server, resulting in full compromise.
Why this severity
CVSS v4.0 base score 9.4 (Critical) reflects high impact on confidentiality, integrity, and availability with low attack complexity and no user interaction required.
What to do about it
No official fix or mitigation is documented in the sources yet. Monitor the vendor advisory and apply the patch as soon as it is released.
No fix documented in sources
Timeline
- Jul 20, 2026 · 13d agoPublishedDisclosed and added to the National Vulnerability Database.
- Jul 23, 2026 · 10d agoAdvisory updatedThe NVD record was last revised.