Astroid Framework (astroid) 2.0.0 to 3.3.10 - Unauthenticated Arbitrary File Upload (RCE)

Astroid Framework by TemPlaza, versions 2.0.0 through 3.3.10, exposes an improperly secured file management feature on its AJAX endpoint. An unauthenticated attacker can upload dangerous file types, leading to remote code execution on the server. Astroid is a template framework, so the vulnerable code is present on every site whose template is built on it, regardless of which template is active. Fixed in 3.3.11, which the vendor released on 5 March 2026 with the note "Fixing security vulnerabilities at the AJAX endpoint". Update the Astroid Framework plugin to 3.3.11 or later (current release is 3.4.2). There is no configuration-level mitigation: the endpoint is reachable without a login.

Affected versions: ≥ 2.0.0 and ≤ 3.3.10

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions