Affected versions: ≥ 2.0.0 and ≤ 3.3.10
Full advisory: github.com
CVE-2026-21628CriticalCVSS 10.0CVE published 5 March 2026Added to mySites.guru 5 March 2026
Astroid Framework (astroid) 2.0.0 to 3.3.10 - Unauthenticated Arbitrary File Upload (RCE)
Astroid Framework by TemPlaza, versions 2.0.0 through 3.3.10, exposes an improperly secured file management feature on its AJAX endpoint. An unauthenticated attacker can upload dangerous file types, leading to remote code execution on the server. Astroid is a template framework, so the vulnerable code is present on every site whose template is built on it, regardless of which template is active. Fixed in 3.3.11, which the vendor released on 5 March 2026 with the note "Fixing security vulnerabilities at the AJAX endpoint". Update the Astroid Framework plugin to 3.3.11 or later (current release is 3.4.2). There is no configuration-level mitigation: the endpoint is reachable without a login.
Is my site affected?
- Affected
- Astroid Framework from 2.0.0 up to and including 3.3.10
- Fixed in
- A release after 3.3.10
- What to do
- Update Astroid Framework to the newest release from the vendor. This flaw covers versions up to 3.3.10, so any later release is outside it.
How CVE-2026-21628 is scored
The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
10.0 Critical
CVSS 4.0, scored by Joomla CNACVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:YHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- AT:N Attack requirements
- None. Works against any affected install
- PR:N Privileges required
- None. No account needed
- UI:N User interaction
- None. Nobody has to be tricked into anything
What it does to the site
- VC:H Confidentiality
- High. Everything the site holds can be read
- VI:H Integrity
- High. Data and files can be altered at will
- VA:H Availability
- High. The site can be taken down
What it does beyond the site
- SC:H Confidentiality
- High. Data on other systems can be read
- SI:H Integrity
- High. Other systems can be altered
- SA:H Availability
- High. Other systems can be taken down
Timeline
- 5 March 2026CVE-2026-21628 record published by its CNA
- 5 March 2026mySites.guru check added for Astroid Framework (from 2.0.0 up to and including 3.3.10)
Rule details
Other vulnerabilities in Astroid Framework
Updating for CVE-2026-21628 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
Astroid Framework
Latest safe version: 3.5.0
References
- CVE-2026-21628 on cve.org (the official CVE record)
- CVE-2026-21628 in the NIST National Vulnerability Database
- github.com/templaza/astroid-framework/releases/tag/v3.3.11
CVE-2026-21628 questions
Which versions are affected by CVE-2026-21628?
CVE-2026-21628 affects Astroid Framework from 2.0.0 up to and including 3.3.10.
How do I fix CVE-2026-21628?
Update Astroid Framework to the newest release from the vendor. This flaw covers versions up to 3.3.10, so any later release is outside it.
How severe is CVE-2026-21628?
Joomla CNA scores it 10.0 (Critical) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.