CVE-2026-84048 — Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery…

CVE-2026-84048

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 PUBLISHED

Description (CNA)

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

Affected (CNA)

Vendor / product	Versions
joomgalleryfriends.net / JoomGallery extension for Joomla	affected 4.0.0-4.4.1

CWE

CWE-284

References

https://www.joomgalleryfriends.net/

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.