Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE
CVE-2026-48939
Verified
Description
iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges.
Severity
Critical
CVSS Score
9.8
Exploit Probability
20%
Affected Product
icagenda
Published Date
August 6, 2026
Template Author
0x_akoko
CVE-2026-48939.yaml
9.8Score
CVSS Metrics
CVSS Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVE ID:
cve-2026-48939
CWE ID:
cwe-434
Remediation Steps
Update to the latest version of iCagenda extension.