rootpwn

critical · CVSS v3 8.8 · CVSS v4 9.4

CVE-2026-88857

The OrdaSoft Joomla Gallery extension allows authenticated privileged users to upload arbitrary PHP files via the watermark function, storin

Overview

The OrdaSoft Joomla Gallery extension allows authenticated privileged users to upload arbitrary PHP files via the watermark function, storing them in a web-accessible directory without sanitization, enabling remote code execution. This flaw affects all Joomla sites using the extension before version 6.2.7.

Description

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.

Impact

Confidentiality: attackers can read site files. Integrity: attackers can modify or delete content. Availability: attackers can disrupt site operation. Impacted parties: site administrators, users, and any organization hosting the vulnerable extension.

Remediation

Upgrade OrdaSoft Joomla Gallery to version 6.2.7 or later. If upgrade not possible, disable the watermark upload feature or restrict file types to images only, and ensure the upload directory is not web-accessible. Apply Joomla core security updates and enforce least privilege for core.manage users.

Risk context

Severity is critical with CVSS 8.8/9.4. No EPSS data. Immediate attention required to prevent exploitation.

Affected products

  • OrdaSoft Joomla Gallery
  • Joomla CMS

Scores

Severity
critical
CVSS v2
6.5
CVSS v3
8.8
CVSS v4
9.4
EPSS
—

Joomla OrdaSoft Remote Code Execution Privilege Escalation File Upload Critical Web Application

← All CVEs

Related CVEs

critical

CVE-2026-88854

The vulnerability is an unauthenticated SQL injection in the OrdaSoft Joomla Gallery extension’s search endpoint. It allows attackers to execute arbitrary SQL queries and exfiltrate database contents without authentication. The flaw exists because the getVar() method is not properly sanitized.

View analysis

critical

CVE-2026-94095

A vulnerability has been found in Netcore NBR200V2 1.3.241127.071246. Affected by this vulnerability is an unknown functionality of the file /usr/bin/network_tools of the component Traceroute Diagnostic Feature. The manipulation of the argument url leads to command injection. The attack may be initiated remotely. The exploit has been disclosed to the public and may be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94096

A vulnerability was found in Netcore NBR200V2 1.3.241127.071246. Affected by this issue is some unknown functionality of the file /usr/bin/network_tools of the component LAN IP Configuration Handler. The manipulation of the argument ipv4 results in command injection. The attack may be launched remotely. The exploit has been made public and could be used. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis

critical

CVE-2026-94097

A vulnerability was determined in Netcore NBR200V2 1.3.241127.071246. This affects an unknown part of the file /www/cgi-bin/network_tools of the component CGI Diagnostic Endpoint. This manipulation of the argument param/key/val causes command injection. Remote exploitation of the attack is possible. The exploit has been publicly disclosed and may be utilized. The vendor was contacted early about this disclosure but did not respond in any way.

View analysis