CVE-2026-61424

CriticalCVSS 10.0

Published: 20/07/2026(UTC)Updated: 24/10/2026(UTC)Translated: 24/07/2026(UTC)NVD NIST

Exploitation Probability (EPSS)

Low risk

0.45%

38th percentile - higher than 38% of all known CVEs

Summary

The Joomla extension DJ-Classifieds versions below 3.11.2 is vulnerable to unauthenticated arbitrary file upload. An attacker without authentication can upload any file, leading to full remote code execution (RCE).

Risk Assessment

Lack of authentication allows an attacker to fully compromise the server, steal data, or install a backdoor without any restrictions.

Recommendation

Update the DJ-Classifieds extension to version 3.11.2 or later. Implement authentication mechanisms and file upload validation.

Other vulnerabilities in DJ-Classifieds

CVE-2026-105605Medium
The Joomla DJ-Classifieds extension before 3.11.3 contains an IDOR vulnerability in the "duplicate my ad" feature of the new-ad form. An advert is loaded by its raw numeric ID without verifying that it belongs to the requesting user or whether it is published, blocked, or a pending draft, allowing any logged-in user to retrieve the full content of another user's ad, including contact details and price.

Original NVD description (English source)

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.

Vulnerability data from NVD (NIST) · CISA KEV · EPSS