EasyDiscuss (com_easydiscuss) 4.0.2 to 5.0.15 - Authenticated Arbitrary File Upload, Stored XSS and Access Control Bypass

EasyDiscuss by StackIdeas, versions up to and including 5.0.15, is affected by four issues fixed together in 5.0.16: CVE-2026-21625, user-supplied uploads are validated by file extension only with no MIME type check, allowing dangerous file types to be stored; CVE-2026-21623 and CVE-2026-21624, missing input filtering leads to persistent XSS in forum post handling and in user avatar text handling; and CVE-2026-21626, access control settings for forum post custom fields are not applied to the JSON output type, disclosing restricted field data. All four require a registered forum account. Update to EasyDiscuss 5.0.16 or later. This rule starts at 4.0.2 to avoid matching the OSMap and Xmap EasyDiscuss companion plugins, which report their own low version numbers under the same element.

Affected versions: ≥ 4.0.2 and ≤ 5.0.15

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions