Skip to main content
mySites.guru
Free Audit
NewAdd every Joomla and WordPress site on a WHM or cPanel server in one goSee how it works
CVE-2026-105604CriticalCVSS 9.3CVE published 2 November 2026Added to mySites.guru 2 November 2026

DJ-Classifieds (com_djclassifieds) below 3.11.3 - SQL Injection, Unrestricted Upload and Missing Ownership Checks

DJ-Classifieds 3.11.3, released on 2 November 2026, is a security release. The vendor changelog lists fixes for unrestricted uploads, SQL injection and missing ownership checks. Comparing the 3.11.2 and 3.11.3 code confirms: the djcf_latlon location cookie now reaches the distance search queries as a number rather than raw SQL; the advert save no longer accepts the item id and other server-controlled columns from the submitted form; profile, category and custom-field image uploads now check the real file type rather than the browser-sent type; payment, order, offer and advert-copy actions now verify the logged-in user owns the record; and the image rotate task is confined to the temporary upload folder. The bundled PayPal payment plugin was also hardened. The Joomla CNA has published three CVEs for this release, all credited to Ala Arfaoui: CVE-2026-105603, an upload flaw that lets any registered account reach remote code execution (CVSS 4.0 9.4 Critical); CVE-2026-105604, an unauthenticated SQL injection in the frontend search (9.3 Critical); and CVE-2026-105605, an IDOR in the duplicate-my-ad feature that shows other sellers' adverts to any logged-in user (5.3 Medium). Update every site to DJ-Classifieds 3.11.3. Sites still below 3.11.2 are additionally affected by the separate unauthenticated file upload fixed in 3.11.2 (CVE-2026-61424).

Is my site affected?

Affected
DJ-Classifieds before 3.11.3
Fixed in
3.11.3
What to do
Update DJ-Classifieds to 3.11.3 or later.
Check whether your sites are affected

How CVE-2026-105604 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

9.3 Critical

CVSS 4.0, scored by Joomla CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector
Network. Reachable across the internet
AC:L Attack complexity
Low. Nothing to work around, it just works
AT:N Attack requirements
None. Works against any affected install
PR:N Privileges required
None. No account needed
UI:N User interaction
None. Nobody has to be tricked into anything

What it does to the site

VC:H Confidentiality
High. Everything the site holds can be read
VI:H Integrity
High. Data and files can be altered at will
VA:H Availability
High. The site can be taken down

What it does beyond the site

SC:N Confidentiality
None. Other systems keep their data
SI:N Integrity
None. Other systems keep their integrity
SA:N Availability
None. Other systems stay up

Timeline

  1. 2 November 2026CVE-2026-105604 record published by its CNA
  2. 2 November 2026mySites.guru check added for DJ-Classifieds (before 3.11.3)
  3. 2 November 2026We published: DJ-Classifieds 3.11.3 Fixes SQL Injection, Upload and Ownership Flaws

Rule details

Our disclosure post

DJ-Classifieds 3.11.3 Fixes SQL Injection, Upload and Ownership Flaws

DJ-Classifieds 3.11.3 Fixes SQL Injection, Upload and Ownership Flaws

DJ-Classifieds 3.11.3 for Joomla fixes SQL injection, unrestricted uploads and ownership flaws. Our code review also found a PayPal-plugin code-execution path.

Other vulnerabilities in DJ-Classifieds

Updating for CVE-2026-105604 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

DJ-Classifieds

Latest safe version: 3.11.3

References

CVE-2026-105604 questions

Which versions are affected by CVE-2026-105604?
CVE-2026-105604 affects DJ-Classifieds before 3.11.3. The fix is in 3.11.3.
How do I fix CVE-2026-105604?
Update DJ-Classifieds to 3.11.3 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-105604?
Joomla CNA scores it 9.3 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 11 November 2026.