Affected versions: ≥ 1.0.0 and < 8.3.16
Full advisory: our disclosure post
CVE-2026-102427CriticalCVSS 10.0CVE published 30 September 2026Added to mySites.guru 30 September 2026
OS CCK (com_os_cck) below 8.3.16 - Unauthenticated Arbitrary File Upload (RCE)
OrdaSoft OS CCK versions 1.0.0 to 8.3.15 let anyone upload and run PHP on the site with no login. The front-end upload handler (site/uploader.php, reached through the component's normal routing as task=getContent) has no authentication or permission check. It checks the uploaded file's content with a magic-byte MIME test, but the file-extension allow-list that should restrict the saved name was commented out, so the extension is taken straight from the attacker's filename and the file is written under the site's /images folder, where PHP executes it. A file that starts with valid image bytes and has PHP appended passes the check as a .php file. CVE-2026-102427, CVSS 4.0 10.0 Critical. OrdaSoft fixed this in 8.3.16 by enforcing a jpg/jpeg/png/gif/webp extension allow-list. OrdaSoft's Joomla update manifest still advertises 8.3.14, so sites are not offered 8.3.16 automatically: download it from ordasoft.com and install it by hand. The Pro edition shares the element; its fixed version could not be confirmed. If you cannot update, disable the component, and check /images/com_os_cck*/original/ for any .php file.
Is my site affected?
- Affected
- OS CCK from 1.0.0 up to but not including 8.3.16
- Fixed in
- 8.3.16
- What to do
- Update OS CCK to 8.3.16 or later.
How CVE-2026-102427 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
10.0 Critical
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:YHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:H Integrity
- High. Data and files can be altered at will
- VA:H Availability
- High. The site can be taken down
What it does beyond the site
- SC:H Confidentiality
- High. Data on other systems can be read
- SI:H Integrity
- High. Other systems can be altered
- SA:H Availability
- High. Other systems can be taken down
Timeline
- 30 September 2026CVE-2026-102427 record published by its CNA
- 30 September 2026mySites.guru check added for OS CCK (from 1.0.0 up to but not including 8.3.16)
- 30 September 2026We published: OS CCK 8.3.16 for Joomla Fixes a No-Login PHP Upload and an SQL Injection, but the Updater Still Offers 8.3.14
Rule details
Our disclosure post
Other vulnerabilities in OS CCK
Updating for CVE-2026-102427 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
References
- CVE-2026-102427 on cve.org (the official CVE record)
- CVE-2026-102427 in the NIST National Vulnerability Database
- OS CCK 8.3.16 for Joomla Fixes a No-Login PHP Upload and an SQL Injection, but the Updater Still Offers 8.3.14
CVE-2026-102427 questions
Which versions are affected by CVE-2026-102427?
CVE-2026-102427 affects OS CCK from 1.0.0 up to but not including 8.3.16. The fix is in 8.3.16.
How do I fix CVE-2026-102427?
Update OS CCK to 8.3.16 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-102427?
Joomla CNA scores it 10.0 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 20 October 2026.