CVE-2026-105600
HighCVSS 8.6Summary
StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a remote code execution (RCE) vulnerability via setting strings. An attacker can inject and execute arbitrary code on the server.
Risk Assessment
Remote code execution can lead to full server compromise, data theft, and further network attacks.
Recommendation
Update StageIt to a patched version or remove the extension if not used; restrict access to the administrative panel.
Other vulnerabilities in StageIt
See all- CVE-2026-105601Medium
StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a Reflected XSS vulnerability. Malicious JavaScript can be reflected in the server response and executed in the victim's browser.
- CVE-2026-103420High
StageIt extension for Joomla (versions 1.0-5.7.5 and 6.0-6.3.5) contains a CSRF vulnerability for various actions. An attacker can trick a logged-in administrator into performing unintended actions.
Original NVD description (English source)
Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5
Vulnerability data from NVD (NIST) · CISA KEV · EPSS