Event Gallery (com_eventgallery) below 6.5.0 - Authenticated Path Traversal Folder Deletion, CSRF Image Upload and Overwrite, Reflected XSS and Guessable Order IDs

Event Gallery (Core and Extended) versions before 6.5.0 contain several security flaws, fixed by the vendor in 6.5.0 (26 September 2026) and published by the Joomla CNA as five CVEs on 27 September 2026, each listing 1.0.0 to 6.0.0 as affected. 1) CVE-2026-97164 (CVSS 4.0 7.0 High, vendor advisory EGSA-2026-01): path traversal in the Clear Cache task. A backend user allowed to manage Event Gallery (by default every Administrator, not only Super Users) could use the images parameter of the cache.process task to recursively delete any folder the web server can write to, up to the whole site. 2) CVE-2026-97165 (5.3 Medium, EGSA-2026-02): the Back link of the frontend upload page base64-decoded its return parameter and printed it unvalidated, allowing a crafted link to redirect an editor to another site or run script in their session (reflected XSS and open redirect); the page also printed the event folder name unescaped. 3) CVE-2026-100747 (5.1 Medium, EGSA-2026-03): the upload task in both the backend and the frontend did not check the Joomla form token, so a page on another website could make a logged-in editor or frontend publisher upload images into an event and replace existing images of the same name. Uploads remain restricted to jpg, gif, png, webp and mp4 files with a matching MIME type, so this is a content-integrity attack rather than code execution. 4) CVE-2026-100748 (6.9 Medium, EGSA-2026-04): adding and removing cart items needed no token, so another site could change a visitor's cart. 5) CVE-2026-100749 (5.1 Medium, EGSA-2026-05): the backend clean-up links (orphaned file entries, carts older than 30 days) had no token check. Also hardened in 6.5.0 without a CVE: the email template test-mail button, the Sync Database and Thumbnail Creator tools and three backend AJAX requests lacked token or permission checks, and cart and order identifiers were derived only from the creation timestamp, so anyone knowing roughly when an order was placed could work out its identifier (download links were protected by a separate random token). Update to Event Gallery 6.5.0 or later (it requires Joomla 5.4 or Joomla 6). Carts and orders created before the update keep their old, guessable identifiers. If you override the backend or frontend upload layout (upload/default.php) in your template, update the override, as the upload now requires the token. Until you can update, restrict who has manage and edit permission on Event Gallery.

How CVE-2026-100748 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

The rule below is rated High for the set of 5 CVEs it covers together, not for this record on its own.

Timeline

1. 26 September 2026mySites.guru check added for Event Gallery (before 6.5.0)
2. 26 September 2026We published: Event Gallery 6.5.0 Hides Eight Security Fixes in 46 Bug Fixes
3. 27 September 2026CVE-2026-100748 record published by its CNA

Rule details

Our disclosure post

Event Gallery 6.5.0 Hides Eight Security Fixes in 46 Bug Fixes

Event Gallery 6.5.0 fixes five CVEs in Joomla, led by a Clear Cache path traversal (CVE-2026-97164). The vendor's notes now lead with security.

26 Sept 2026

Other vulnerabilities in Event Gallery

Updating for CVE-2026-100748 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

References

• CVE-2026-100748 on cve.org (the official CVE record)
• CVE-2026-100748 in the NIST National Vulnerability Database
• Event Gallery 6.5.0 Hides Eight Security Fixes in 46 Bug Fixes