Intel

CVE-2026-48939

iCagenda iCagenda — iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability

criticalKEV: actively exploitedPoCEPSS 20%

Description

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Source: CISA_KEVNVDCVEORGCVELISTV5

Response & Mitigation

Why act now?

Prioritisation rationale

With a CVSS score of 9.8 (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) and an EPSS percentile of 97.2 %, this vulnerability represents one of the highest-probability exploitation risks currently tracked: an unauthenticated remote attacker can upload and execute arbitrary PHP code with no preconditions, achieving full server compromise in a single HTTP request. The broad version range affected (all iCagenda releases from 3.2.1 through 4.0.8) means any Joomla site running the extension is exposed, making this particularly relevant for municipalities, event-management organisations, and NIS2-scoped entities that use Joomla for public-facing services. Although CISA has not flagged known ransomware campaign use, unauthenticated RCE of this severity is a textbook initial-access vector for lateral movement, credential harvesting, and data exfiltration; treat patch deployment as a P1/critical priority with no grace period.

Runbook · Step 1

Immediate response (0-24 h)

  • Apply the vendor patch immediately: iCagenda versions 3.2.1–3.9.15 and 4.0.0–4.0.8 are all affected. Retrieve the fixed release from the vendor advisory at https://extensions.joomla.org or the joomlic/icagenda GitHub repository and deploy without delay.
  • Disable the file attachment feature: Until the patch is in place, turn off the attachment upload feature in iCagenda (Components → iCagenda → Configuration) to eliminate the attack surface entirely.
  • Block PHP execution in the upload directory: Add a server-level control (.htaccess php_flag engine off for Apache; remove fastcgi_pass for the upload path in nginx) to prevent PHP interpretation inside the iCagenda upload directory (/components/com_icagenda/ or the configured upload path).
  • Hunt for dropped web shells: Search the upload directory for newly created PHP files: find /var/www -path '*/com_icagenda*' -name '*.php' -newer /var/www/index.php. Quarantine and forensically preserve any suspicious files before deletion.
  • Activate or tune WAF rules: Block multipart upload requests to the iCagenda endpoint that contain PHP MIME types (application/x-php, text/x-php) or PHP magic bytes (<?php) in the request body.
  • Rotate Joomla administrator credentials: Reset passwords and invalidate active sessions for all Joomla admin accounts; enforce MFA if not already active.

Runbook · Step 2

Mitigation layers

  • Network segmentation: Place the Joomla web server in a DMZ and apply strict egress filtering on the web server process (www-data, apache) to block reverse-shell callbacks and C2 beaconing to unexpected destinations.
  • Server-level PHP execution lockdown: Configure PHP-FPM or mod_php so that the entire upload/media/tmp directory tree is excluded from PHP interpretation at the server configuration level — a .htaccess file placed by an attacker can override application-level controls.
  • IPS signature: Deploy a Suricata rule targeting POST requests to com_icagenda with PHP content in the body: alert http any any -> $HTTP_SERVERS 80 (msg:"CVE-2026-48939 iCagenda PHP Upload"; content:"option=com_icagenda"; content:"<?php"; http_client_body; sid:2026489390; rev:1;).
  • Least-privilege for the web server process: Verify that the web server process has write access only to explicitly defined upload directories and cannot write to any directory on the system PATH.
  • PHP open_basedir restriction: Set open_basedir to the Joomla document root to prevent uploaded code from traversing to system files outside the web root.
  • File integrity monitoring baseline: Establish a clean file-system baseline (e.g., Akeeba Admin Tools or an external FIM solution) before patching; use it to detect any files introduced during the exposure window.

Runbook · Step 3

Detection rules

  • Web server access log correlation: Look for a POST to a com_icagenda endpoint followed within seconds by a GET to a .php file under the upload path. SPL: index=webserver sourcetype=access_combined method=POST uri="*com_icagenda*" | join session_id [search method=GET uri="*.php" uri_path="*/com_icagenda/*"].
  • Filesystem event monitoring (auditd / Sysmon): Alert on PHP file creation by the web server process. auditd: auditctl -w /var/www/html -p w -k icagenda_php_drop. Sigma shape: EventID: 11, TargetFilename|endswith: ['.php','.phtml','.phar'], Image|contains: 'php-fpm'.
  • Suspicious process ancestry (EDR): Alert when php-fpm, apache2, or httpd spawns a shell or download utility (bash, sh, curl, wget, python3, perl). KQL: process_parent_name in ("php-fpm","apache2","httpd") and process_name in ("bash","sh","curl","wget","python3").
  • Outbound network telemetry (Zeek / Suricata): Correlate POST requests to com_icagenda with outbound TCP connections from the web server host to non-standard ports (anything other than 80, 443, 3306) within a 5-minute window.
  • Joomla application log: Monitor /administrator/logs/ for com_icagenda entries referencing file operations with unexpected extensions; a spike in errors or unknown MIME types is an early indicator of probing or exploitation.

Metrics

Severity
critical
Priority score
234.03
KEV status
Actively exploited
Exploit maturity
actively exploited (KEV)
XIEM Effective CVSS
10.0
Source: nvd-v4
CVSS v3
9.8
CVSS v4
10.0
EPSS percentile
97.2 %
Critical — this CVE ranks in the top fifth of all CVEs scored today (rank ≥ 80%).
EPSS score
19.7 %
Elevated — model estimates 10-50% exploitation likelihood.
Published
2026-07-10 00:00 UTC
CWE
CWE-434

Weakness classes (CWE)

  • CWE-434Base

    Unrestricted Upload of File with Dangerous Type

    The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

    cwe.mitre.org →

Reanalysis & status changes

Chronological NVD audit events for this CVE — reanalyses, CVSS updates, CPE diffs.

  1. CVE Modified2026-07-05 15:16 UTC· security@joomla.org
    • CWE: CWE-434
    • CWE: CWE-284
  2. CVE Modified2026-07-03 04:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • SSVC: {"id":"CVE-2026-48939","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalI… → {"id":"CVE-2026-48939","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalI…
  3. CVE Modified2026-07-02 17:16 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
    • SSVC: {"id":"CVE-2026-48939","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technical… → {"id":"CVE-2026-48939","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalI…
  4. CVE Modified2026-06-24 19:17 UTC· 134c704f-9b21-4f2e-91b3-4a467353bcc0
    • Reference: https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/
    • Reference: https://www.icagenda.com/docs/changelog/icagenda-3-9-15
    • Reference: https://www.icagenda.com/docs/changelog/icagenda-4-0-8
  5. New CVE Received2026-06-20 13:16 UTC· security@joomla.org
    • Affected: iCagenda extension for Joomla
    • Description: A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
    • CVSS V4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red
    • CWE: CWE-284

Affected products

Products and version ranges extracted from the vendor/CERT advisory. A range like „<4.14.6“ implies the update recommendation „upgrade to 4.14.6 or later“.

  • joomlic

    icagenda3.2.1 – 3.9.15

  • joomlic

    icagenda4.0.0 – 4.0.8

Public exploit references

Public proof-of-concepts and detection templates for this vulnerability. Maturity ranges from reported PoCs through working detection scripts up to fully weaponized exploit modules. NEOSEC mirrors the code internally for forensic analysis; externally we only link to the original sources.

References & sources

IDCVE-2026-48939