{"id":"CVE-2026-102427","title":"Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or AC…","summary":"Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or AC…","severity":"critical","cvss":10,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","cwe":["CWE-434"],"vendor":"ordasoft","product":"joomla_cck","affected":["joomla_cck >= 1.0.0, < 8.3.16"],"patched":["joomla_cck 8.3.16"],"published":"2026-09-30","updated":"2026-10-01","sourceUpdated":"2026-10-01T13:46:23.090","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-102427","references":[{"url":"https://www.ordasoft.com/","label":"security@joomla.org"}],"tags":["nvd","exploit-available","cve.org"],"epss":0.00932,"epssPercentile":0.60512,"exploits":{"github":1,"githubRepos":["https://github.com/murrez/CVE-2026-102427"],"checkedAt":"2026-10-27T16:53:21.947Z"},"exploitAvailable":true,"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-09-30T15:37:09.374454Z"},"ingestedAt":"2026-09-30T16:10:07.390Z","slug":"CVE-2026-102427","body":"## Overview\n\nJoomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.\n\n## Affected\n\n- `joomla_cck >= 1.0.0, < 8.3.16`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `joomla_cck 8.3.16`","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":55,"likelihood":0.2,"exploitation":12,"ransomware":0},"changes":[{"seq":214294,"id":"CVE-2026-102427","ts":1790866028605,"field":"exploit_available","old":"false","new":"true"}]}