iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability (CVE-2026-48939)

What is affected, what to do

A critical unrestricted file upload vulnerability (CWE-434) in joomlic iCagenda allows an unauthenticated remote attacker to upload arbitrary files, leading to full remote code execution on the underlying server. No authentication or user interaction is required, making exploitation trivial. The vulnerability is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities catalog. Organizations running Joomla instances with the iCagenda plugin must act immediately by applying available patches or disabling the plugin until remediation is confirmed.

The vulnerability is being actively exploited; treat it as a priority. Update icagenda to version 3.9.15. Immediate actions, mitigation and detection rules are in the runbook below.

Affected

• Icagenda.com iCagenda extension for Joomla eq 3.2.1-4.0.7..3.2.1-4.0.7

Not sure whether and how you are affected? Ask a question about this vulnerability

Metrics

Response and mitigation

1. 01

   Runbook step 1

   Immediate response (0-24 h)

   • Inventory: Find every Joomla instance running com_icagenda, including agency-hosted, campaign and community sites that sit outside central IT. Check the version under System → Manage Extensions. Versions 3.2.1 through 4.0.7 are affected.
   • Patch: Upgrade to iCagenda 3.9.15 on the 3.x branch or iCagenda 4.0.8 on the 4.x branch. Take a filesystem and database snapshot first, so you keep forensic evidence.
   • If you cannot patch today: Unpublish the frontend "Submit an Event" menu item. Alternatively, disable the component or block option=com_icagenda with view=submit at the reverse proxy or WAF.
   • Compromise sweep: Search the iCagenda upload directories (typically under images/ — confirm the path in the component configuration) and the whole webroot for .php, .phtml, .phar, .php5, .php7 and .inc files modified after installation, e.g. find /var/www -newer configuration.php -name "*.ph*".
   • If you find a webshell: Isolate the host and preserve logs. Rotate the DB password from configuration.php, all Joomla admin accounts, the $secret value, and any SMTP or API credentials. Rebuild the site from a known-good state rather than cleaning it in place.
   • Reporting: For confirmed code execution on NIS2-scope systems, start the 24-hour early-warning notification to your national CSIRT or competent authority.
2. 02

   Runbook step 2

   Mitigation layers

   • Web server config: Disable PHP execution in all upload and media directories.
     • Apache: <Directory "/var/www/html/images"> php_admin_flag engine off </Directory>, or in .htaccess: <FilesMatch "\.(php|phtml|phar|php\d)$"> Require all denied </FilesMatch>.
     • nginx: location ~* ^/images/.*\.(php|phtml|phar)$ { deny all; }.
   • WAF/IPS: Deny multipart POSTs to option=com_icagenda whose filename= ends in an executable extension. Also catch double extensions such as .php.jpg and null-byte tricks. ModSecurity sketch: SecRule ARGS_GET:option "@streq com_icagenda" "chain,deny,id:1048939" SecRule FILES_NAMES|FILES "@rx \.(ph(p\d?|tml|ar)|inc)(\.|$)".
   • IAM/least privilege: In the iCagenda options, restrict frontend submission to authenticated, trusted user groups. Turn off file attachments on submission forms entirely if the business does not need them.
   • PHP hardening: Set disable_functions to exec,shell_exec,system,passthru,proc_open,popen and confine open_basedir to the webroot. Run the PHP-FPM pool as a dedicated user with no write access to code directories.
   • Segmentation: Restrict web server egress to required destinations (update servers, SMTP relay). This blocks tool downloads, reverse shells and mining pools. Keep the database reachable only from the web tier.
   • File integrity: Monitor the Joomla webroot with FIM (AIDE, Wazuh syscheck, or EDR) and alert on any new executable file.
3. 03

   Runbook step 3

   Detection rules

   • Web access logs: Look for a POST to index.php?option=com_icagenda (especially view=submit) followed shortly by a GET from the same source IP to a .php file under images/. SPL: index=web uri_path="/images/*" uri_path="*.php*" status=200 | stats count by src_ip, uri_path
   • EDR/Sysmon process ancestry: Alert when apache2, httpd, php-fpm or nginx spawns sh, bash, curl, wget, python, perl or nc. Sigma shape: ParentImage|endswith: ['/php-fpm','/apache2','/httpd'] and Image|endswith: ['/sh','/bash','/curl','/wget'].
   • Linux auditd: Capture execve events with uid=www-data (or apache/nginx) where exe is not the PHP-FPM binary. Rule: -a always,exit -F arch=b64 -S execve -F uid=33 -k web_exec.
   • Filesystem/FIM: Flag new files with a PHP extension or PHP content (<?php, eval(, base64_decode(, assert() in iCagenda upload or media directories. Sources: Sysmon for Linux EID 11 or Wazuh "file added" alerts.
   • Network (Zeek/Suricata): Watch for new outbound connections from web servers to unfamiliar hosts or mining ports. Also flag unusually large HTTP responses to requests for files under images/, which can indicate data theft through a webshell.

Detection rules

No NEOSEC detection rule is available for this vulnerability yet.

Classification under NIS2 and CRA

Rule-based classification from exploitation status and severity. It does not replace a case-by-case assessment.

NIS2

NIS2 is EU Directive (EU) 2022/2555 to raise the level of cybersecurity across the Union. It substantially broadens obligations compared with the first NIS directive: more sectors, mandatory risk management, staged reporting duties and personal accountability of senior management.

Read in glossary

Actively exploited: treat the vulnerability as a priority in vulnerability handling under Art. 21(2)(e) NIS2. If it is exploited in your environment, check the reporting obligation under Art. 23 (early warning within 24 hours).

CRA

The CRA is EU Regulation (EU) 2024/2847 setting horizontal cybersecurity requirements for „products with digital elements“ — from industrial controllers and software to connected consumer devices. For the first time manufacturers must ensure security across the entire product lifecycle, handle vulnerabilities and provide security updates.

Read in glossary

Since 11.09.2026, manufacturers of affected products with digital elements must report actively exploited vulnerabilities under Art. 14 CRA, with an early warning within 24 hours via ENISA's single reporting platform.

ISO/IEC 27001

ISO/IEC 27001 is the internationally leading standard for an information security management system (ISMS). It describes a risk-based, process-oriented framework to systematically plan, implement, review and improve information security.

Read in glossary

Control A.8.8, management of technical vulnerabilities: assess relevance to your systems, plan remediation and keep evidence.

Description

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Source: NVD (NIST), CISA KEV Catalog, CVE.org (MITRE), cvelistv5

Vendors and products

• Icagenda.com Icagenda Extension For Joomla

Weakness classes (CWE)

• CWE-434Unrestricted Upload of File with Dangerous Type

  Base

  The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

  Entry at MITRE CWE-434

• CWE-434Unrestricted Upload of File with Dangerous Type

  Base

  The product allows the upload or transfer of dangerous file types that are automatically processed within its environment.

  Entry at MITRE CWE-434

References & sources

• icagenda.comProduct, Product
• mysites.gurublog/icagenda-zero-day-file-upload-rceThird-party advisory, Third-party advisory
• icagenda.comdocs/changelog/icagenda-3-9-15Patch, Release notes
• icagenda.comdocs/changelog/icagenda-4-0-8Patch, Release notes
• github.comPolosss/By-Poloss..-..CVE-2026-48939Exploit, Exploit, Third-party advisory
• cisa.govknown-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939government-resource, US government resource

Changes to this CVE

Who changed this CVE and when: NVD (analysis, affected products, CVSS), the CVE publisher (CNA) and additional providers such as CISA (ADP).

1. 05.07.2026Record modifiedJoomla

   Weakness type: CWE-434

   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Weakness type (CWE)	added	—	CWE-434
   Weakness type (CWE)	removed	CWE-284	—

   Source identifier: security@joomla.org

2. 03.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: proof of concept, automatable: yes

   Show the original change

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   SSVC assessment	changed	{"id":"CVE-2026-48939","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-02T16:14:42.278706Z"}	{"id":"CVE-2026-48939","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-06-24T00:00:00+00:00"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

3. 02.07.2026Record modifiedCISA ADP

   CISA assessment (SSVC): exploitation: proof of concept, automatable: yes

   New references:

   • https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
   Show 2 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
   SSVC assessment	changed	{"id":"CVE-2026-48939","role":"CISA Coordinator","options":[{"exploitation":"none"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-06-24T00:00:00+00:00"}	{"id":"CVE-2026-48939","role":"CISA Coordinator","options":[{"exploitation":"poc"},{"automatable":"yes"},{"technicalImpact":"total"}],"version":"2.0.3","timestamp":"2026-07-02T16:14:42.278706Z"}

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

4. 24.06.2026Record modifiedCISA ADP

   New references:

   • https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/
   • https://www.icagenda.com/docs/changelog/icagenda-3-9-15
   • https://www.icagenda.com/docs/changelog/icagenda-4-0-8
   Show 3 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Reference	added	—	https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/
   Reference	added	—	https://www.icagenda.com/docs/changelog/icagenda-3-9-15
   Reference	added	—	https://www.icagenda.com/docs/changelog/icagenda-4-0-8

   Source identifier: 134c704f-9b21-4f2e-91b3-4a467353bcc0

5. 20.06.2026ReceivedJoomla

   CVSS V4.0: AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y/U:Red

   Weakness type: CWE-284

   Description added or changed

   New references:

   • https://www.icagenda.com/
   Show 5 original changes

   Individual changes of this event as published by NVD

   Type	Action	Before	After
   Affected versions (publisher)	added	—	iCagenda extension for Joomla
   Description	added	—	A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
   CVSS	added	—	AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red
   Weakness type (CWE)	added	—	CWE-284
   Reference	added	—	https://www.icagenda.com/

   Source identifier: security@joomla.org

One NVD translation into another language is hidden.