Affected versions: < 6.5.0
Full advisory: our disclosure post
CVE-2026-100749MediumCVSS 5.1Published 26 September 2026
Event Gallery (com_eventgallery) below 6.5.0 - Authenticated Path Traversal Folder Deletion, CSRF Image Upload and Overwrite, Reflected XSS and Guessable Order IDs
Event Gallery (Core and Extended) versions before 6.5.0 contain several security flaws, fixed by the vendor in 6.5.0 (26 September 2026) and published by the Joomla CNA as five CVEs on 27 September 2026, each listing 1.0.0 to 6.0.0 as affected. 1) CVE-2026-97164 (CVSS 4.0 7.0 High, vendor advisory EGSA-2026-01): path traversal in the Clear Cache task. A backend user allowed to manage Event Gallery (by default every Administrator, not only Super Users) could use the images parameter of the cache.process task to recursively delete any folder the web server can write to, up to the whole site. 2) CVE-2026-97165 (5.3 Medium, EGSA-2026-02): the Back link of the frontend upload page base64-decoded its return parameter and printed it unvalidated, allowing a crafted link to redirect an editor to another site or run script in their session (reflected XSS and open redirect); the page also printed the event folder name unescaped. 3) CVE-2026-100747 (5.1 Medium, EGSA-2026-03): the upload task in both the backend and the frontend did not check the Joomla form token, so a page on another website could make a logged-in editor or frontend publisher upload images into an event and replace existing images of the same name. Uploads remain restricted to jpg, gif, png, webp and mp4 files with a matching MIME type, so this is a content-integrity attack rather than code execution. 4) CVE-2026-100748 (6.9 Medium, EGSA-2026-04): adding and removing cart items needed no token, so another site could change a visitor's cart. 5) CVE-2026-100749 (5.1 Medium, EGSA-2026-05): the backend clean-up links (orphaned file entries, carts older than 30 days) had no token check. Also hardened in 6.5.0 without a CVE: the email template test-mail button, the Sync Database and Thumbnail Creator tools and three backend AJAX requests lacked token or permission checks, and cart and order identifiers were derived only from the creation timestamp, so anyone knowing roughly when an order was placed could work out its identifier (download links were protected by a separate random token). Update to Event Gallery 6.5.0 or later (it requires Joomla 5.4 or Joomla 6). Carts and orders created before the update keep their old, guessable identifiers. If you override the backend or frontend upload layout (upload/default.php) in your template, update the override, as the upload now requires the token. Until you can update, restrict who has manage and edit permission on Event Gallery.
Affected versions: < 6.5.0
Official record: cve.org · NVD
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
How CVE-2026-100749 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
5.1 Medium
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:NHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:H Privileges required
- High. Needs an account with elevated rights
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:N Confidentiality
- None. Nothing can be read
- VI:L Integrity
- Low. Some data can be altered
- VA:N Availability
- None. The site stays up
What it does beyond the site
- SC:N Confidentiality
- None. Other systems keep their data
- SI:N Integrity
- None. Other systems keep their integrity
- SA:N Availability
- None. Other systems stay up
The rule below is rated High for the set of 5 CVEs it covers together, not for this record on its own.
Affected extensions and versions
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 27 September 2026.