CVE-2025-22213 — [20250301] - Core - Malicious file uploads via Media Manager

CVE-2025-22213

[20250301] - Core - Malicious file uploads via Media Manager PUBLISHED

Description (CNA)

Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.

Affected (CNA)

Vendor / product	Versions
Joomla! Project / Joomla! CMS	affected 4.0.0-4.4.11; affected 5.0.0-5.2.4

CWE

CWE-434

References

https://developer.joomla.org/security-centre/961-20250301-core-malicious-file-uploads-via-media-managere-malicious-file-uploads-via-media-manager.html

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.