CVE Catalog
CVE-2026-74803
CriticalCVSS 10.0Summary
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64. The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
Risk Assessment
An attacker can upload malicious files, potentially leading to code execution on the server or data integrity breaches.
Recommendation
Upgrade the Zoo extension to version 4.1.64 or later, which includes a fix for this vulnerability.
Original NVD description (English source)
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.