Unauthenticated File Upload Vulnerability in Joomla Extension by joomlaboat.com

CVE-2026-105606

What is CVE-2026-105606?

An unauthenticated vulnerability exists in the Custom Tables extension for Joomla that allows attackers to upload files to a public directory accessible via the web. This can occur through the submission form exposed on the Joomla site, enabling the upload of polyglot files with extensions controlled by the attacker. Once uploaded, these files can be served as static content, allowing malicious actors to host phishing or malware pages under the site's domain. The risk increases significantly for versions prior to 3.7.8 as file paths are disclosed, further aiding potential exploitation.

References