rootpwn

critical · CVSS v3 8.8 · CVSS v4 9.4

CVE-2026-88856

The vulnerability exists in OrdaSoft Joomla Gallery extension versions prior to 6.2.7, allowing authenticated privileged users to trigger ar

Overview

The vulnerability exists in OrdaSoft Joomla Gallery extension versions prior to 6.2.7, allowing authenticated privileged users to trigger arbitrary PHP functions via the update_osgallery task. This can lead to remote code execution on the web server, compromising site integrity and data. It affects Joomla sites that have the vulnerable extension installed.

Description

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions updateOSGallery(), reached via task=update_osgallery, read a JSON request body and called the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check of any kind. Any function name compatible with a single argument was directly reachable, including system, exec, shell_exec, and passthru.

Impact

Confidentiality, integrity, and availability of the affected Joomla site are at risk. Site administrators and users may experience data exfiltration, unauthorized code execution, and service disruption.

Remediation

Upgrade the OrdaSoft Joomla Gallery extension to version 6.2.7 or later. If an upgrade is not immediately possible, disable the update_osgallery task or restrict it to trusted administrators, and implement a web‑application firewall rule to block JSON payloads containing dangerous function names. Consider patching the extension to validate function names against an allow‑list.

Risk context

The issue is rated critical with CVSS v3 score 8.8 and CVSS v4 score 9.4, indicating a high severity. No EPSS data is available, but the critical rating warrants prompt remediation.

Affected products

  • OrdaSoft Joomla Gallery
  • Joomla CMS

Scores

Severity
critical
CVSS v2
6.5
CVSS v3
8.8
CVSS v4
9.4
EPSS
—

remote-code-execution Joomla OrdaSoft critical web-application extension

← All CVEs

Related CVEs

critical

CVE-2026-88854

The vulnerability is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension’s search endpoint. It allows attackers to execute arbitrary SQL queries and exfiltrate database contents without authentication. The flaw exists because the getVar() method is not properly sanitized.

View analysis

critical

CVE-2026-94095

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94096

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94097

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis