CVE-2026-48939

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

CVSS 4.0

10.0CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red

CVSS 3.1

9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS

20% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-25)

CISA KEV

listed 2026-07-10, due 2026-07-13

CWE

CWE-434

Published

2026-06-20

Modified

2026-10-25

Record from

the NVD, synced 2026-10-25

Affected

• joomlic:icagenda

References

• https://www.icagenda.com/
• https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
• https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939
• https://www.icagenda.com/docs/changelog/icagenda-3-9-15

Check your stackJSON