Joomla Multiple COM Extensions Unauthenticated File Uploads to RCE

Joomla! Multiple COM_Extensions
Unauthenticated File Uploads to RCE

OVERVIEW

SonicWall Capture Labs threat research team became aware of multiple threats affecting Joomla! extensions, assessed their impact, and developed mitigation measures. These flaws, which earned maximum severity scores (CVSS 10.0) and a place in the CISA KEV catalog, are critical vulnerabilities that exist entirely within individual third-party extensions. They can affect any version of Joomla where those specific extensions are installed and running. They allow unauthenticated visitors to upload arbitrary PHP scripts and completely take over servers. For example, CVE-2026-48907 in the widely used Joomla Content Editor (JCE) plugin allow unauthenticated actors to generate malicious editor profiles that execute unauthorized code. A detailed blog post on CVE-2026-48907 is available here.

AFFECTED EXTENSION VERSIONS & FIXES

• CVE-2026-56291 (Balbooa Forms)
  • Vulnerable Versions: Version 2.4.0 and all earlier versions.
  • Fixed Version: Patched in version 2.4.1.
• CVE-2026-56290 (Page Builder CK)
  • Vulnerable Versions: Version 3.5.10 and all earlier versions.
  • Fixed Version: Patched in version 3.6.0 (with retroactive back-ports rolled out for legacy Joomla 3 and 4 branches).
• CVE-2026-48908 (SP Page Builder)
  • Vulnerable Versions: Version 6.6.1 and all earlier versions.
  • Fixed Version: Patched in version 6.6.2.
• CVE-2026-48939 (iCagenda)
  • Vulnerable Versions: Legacy versions 1.0.0 through 3.9.14, and modern versions 4.0.0 through 4.0.7.
  • Fixed Version: Patched in version 4.0.8 (and 3.9.15 for the legacy branch).
• CVE-2026-48907 (Joomla Content Editor / JCE)
  • Vulnerable Versions: All versions from 1.0.0 through 2.9.99.4.
  • Fixed Version: Patched in version 2.9.99.5 and above.

TECHNICAL OVERVIEW

Joomla is built on a standard PHP and MySQL/MariaDB (LAMP/LEMP) stack. Its core software architecture follows a strict Model-View-Controller (MVC) design pattern, which isolates data handling, business logic, and presentation layers. Joomla is a free, open-source Content Management System (CMS) used to build, organize, and manage dynamic websites and powerful online applications.

As can be seen in Figure 1, out of the four types of Joomla extensions, namely Components (com_), Modules (mod_), Plugins (plg_), and Templates (tpl_), the root cause lies in Components (com_). The exploit chain begins at a vulnerable com_ extension.

These five critical vulnerabilities, CVE-2026-56291 (Balbooa Forms), CVE-2026-56290 (Page Builder CK), CVE-2026-48908 (SP Page Builder), CVE-2026-48939 (iCagenda), and CVE-2026-48907 (Joomla Content Editor), allow unauthenticated attackers to completely compromise a server through Remote Code Execution (RCE). While they target different third-party Joomla extensions, they all follow the exact same architectural exploitation path: they exploit a complete lack of Access Control List (ACL) checks at public-facing frontend endpoints to bypass authentication, utilize flawed input validation to upload malicious PHP scripts masquerading as harmless files, write these payloads directly into web-accessible directories, and finally execute them by browsing straight to the file path. The only operational difference lies in the specific entry points and file drop locations, such as Balbooa Forms dropping shells in its uploads folder, SP Page Builder exposing an unauthenticated custom icon upload task, and JCE uniquely allowing attackers to rewrite user editor profiles to authorize the script upload, yet all five effectively neutralize the host Joomla site's core security defenses and grant attackers full control over the underlying web server infrastructure.

TRIGGERING THE VULNERABILITIES

The triggering of these five vulnerabilities follows a uniform, automated exploit lifecycle that collapses all individual variants into a shared technical sequence:

• First, automated scanners target the Joomla host to locate active component pathways, specifically mapping endpoints like com_baforms, com_pagebuilderck, com_sppagebuilder, com_icagenda, or com_jce.
• Second, the attacker transmits a structured HTTP POST request containing a malicious PHP web shell payload directly to an unauthenticated backend upload or configuration task (such as form.ajax_upload, asset.uploadCustomIcon, or profile.save).
• Third, the attacker bypasses weak backend filters by either spoofing the multipart Content-Type header to mimic an image or, in the case of JCE and Page Builder CK, injecting parameters to silently modify the server's extension allowlists and session token states.
• Fourth, because these endpoints entirely lack Joomla ACL validation, the server processes the request anonymously and writes the executable .php file directly into public directories like /images/ or /media/.
• Fifth, the exploit is finalized when a direct HTTP GET request is sent to the drop path (e.g., /images/baforms/uploads/test.php), forcing the web server to interpret the script and grant the attacker full RCE.

EXPLOITATION

Out of these five vulnerabilities, CVE-2026-48907 has been covered in a separate blog. To illustrate the exploitation flow of the remaining vulnerabilities, an exploitation attempt for CVE-2026-48939 is demonstrated in Figures 3 and 4.

SONICWALL PROTECTIONS

To ensure SonicWall customers are prepared for any exploitation that may occur due to these vulnerabilities, the following signatures have been released:

REMEDIATION RECOMMENDATIONS

The first line of defense is updating the vulnerable extensions to their patched versions.

• Balbooa Forms: Update com_baforms to version 2.4.1 or higher.
• Page Builder CK: Update com_pagebuilderck to version 3.6.0 (or apply the specific 3.1.x/3.4.x legacy back-ports depending on your Joomla core version).
• SP Page Builder: Update com_sppagebuilder to version 6.6.2 or higher.
• iCagenda: Update com_icagenda to version 4.0.8 (or legacy 3.9.15).
• Joomla Content Editor (JCE): Update com_jce to version 2.9.99.5 or higher.

With Joomla's growing user base and increasing deployment footprint, organizations and individual users should upgrade to the latest patched versions as outlined in each vendor's official advisory.

RELEVANT LINKS

• https://mysites.guru/blog/
• https://www.sonicwall.com/blog/joomla-content-editor-remote-code-execution
• https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
• https://mysites.guru/blog/sp-page-builder-zero-day-uploadcustomicon-rce/
• https://www.ionix.io/threat-center/cve-2026-56290/
• https://mysites.guru/blog/balbooa-forms-unauthenticated-file-upload-flaw/
• CISA- CVE-2026-56291
• CISA- CVE-2026-56290
• CISA- CVE-2026-48908
• CISA- CVE-2026-48939