CVE-2026-48939 — Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

CVE-2026-48939

Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15 PUBLISHED

Description (CNA)

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Affected (CNA)

Vendor / product	Versions
icagenda.com / iCagenda extension for Joomla	affected 3.2.1-4.0.7

CWE

CWE-434

References

https://www.icagenda.com/

ADP enrichment

CISA-ADP

No English description supplied.

https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/
https://www.icagenda.com/docs/changelog/icagenda-3-9-15
https://www.icagenda.com/docs/changelog/icagenda-4-0-8
https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939