DJ-Classifieds (com_djclassifieds) below 3.11.2 - Unauthenticated Arbitrary File Upload

DJ-Classifieds by DJ-Extensions, all versions before 3.11.2, exposes a front-end file upload endpoint (task=imageupload) that requires no login and validates no CSRF token. An anonymous visitor can write an attacker-named file into the component upload directory, which on a default install is served over the web. Several mitigations were already present in older builds and do reduce the impact: an extension blacklist rejects .php, .phtml, .sh and .js, uploaded content is scanned for patterns such as "<?php", "eval(" and "base64", image extensions are validated with getimagesize(), and temporary files are cleaned up after roughly 12 hours. The content scan only matches the literal "<?php" opening tag, so a short-tag payload ("<?=") survives it, which leaves a polyglot image webshell stored intact and executable on permissive hosts or through a local file inclusion chain. Version 3.11.2 (released 20 July 2026) adds authentication and CSRF/session checks to the imageupload endpoint and enforces a server-side image-only whitelist. Update to 3.11.2 or later. If you cannot update immediately, block POST requests to index.php?option=com_djclassifieds&task=imageupload at the web server or WAF, and check the component upload directory for files you do not recognise. This range also covers the earlier authenticated SQL injection fixed in 3.10.2 (CVE-2025-54474).

Affected versions: < 3.11.2

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

How CVE-2025-54474 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

The rule below is rated Critical for the set of 2 CVEs it covers together, not for this record on its own.

Affected extensions and versions