Affected versions: ≥ 3.7 and < 3.8
Full advisory: www.valorapps.com
CVE-2024-11145CriticalPublished 26 November 2024
Easy Folder Listing Pro (com_easyfolderlistingpro) 3.7 - Unauthenticated Deserialization Remote Code Execution
Valor Apps Easy Folder Listing Pro contains a deserialization flaw that lets an unauthenticated remote attacker execute arbitrary code with the privileges of the Joomla application. CVSS 9.8 (Critical). This row covers the 3.x branch: update to 3.8 or later. The 4.x branch is affected separately at 4.4 and is covered by its own rule, because the two branches were fixed at different version numbers and one range cannot span both.
Affected versions: ≥ 3.7 and < 3.8
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Easy Folder Listing Pro - Easy Folder Listing Pro (com_easyfolderlistingpro) 4.4 - Unauthenticated Deserialization Remote Code Execution
Valor Apps Easy Folder Listing Pro contains a deserialization flaw that lets an unauthenticated remote attacker execute arbitrary code with the privileges of the Joomla application. CVSS 9.8 (Critical). This row covers the 4.x branch: update to 4.5 or later. The 3.x branch is affected separately at 3.7 and is covered by its own rule, because the two branches were fixed at different version numbers and one range cannot span both.
Affected versions: ≥ 4.4 and < 4.5
Full advisory: www.valorapps.com
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.