Affected versions: ≥ 6.0.0 and < 6.1.3
Full advisory: our disclosure post
CVE-2026-57828CriticalPublished 10 July 2026
Phoca Download (com_phocadownload) below 6.1.3 - Authenticated Arbitrary File Upload (RCE)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Fixed in 6.1.3 (10 Jul 2026), which drops allow_unsafe on both File::upload() calls and replaces the front-end allow-list gate ($frontEnd == 1) with (int)$frontEnd > 0. Update to 6.1.3 or later; if you cannot, switch off user uploads (enable_user_cp). This rule covers the 6.x branch only. Phoca never backported the fix to the 3.x, 4.x or 5.x branches, which are tracked as separate advisories.
Affected versions: ≥ 6.0.0 and < 6.1.3
Official record: cve.org · NVD
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Phoca Download - Phoca Download (com_phocadownload) 3.x and earlier - Authenticated Arbitrary File Upload (RCE), no fixed release for Joomla 3
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Phoca fixed this on the 6.x branch only, in 6.1.3 (10 Jul 2026). The Joomla 3 line stops at 3.2.3 (8 Mar 2021) and still holds the vulnerable code: both File::upload() calls pass allow_unsafe=true and the front-end gate is still the pre-fix $frontEnd == 1 test. Verified on 27 Aug 2026 by diffing the released com_phocadownload zips. Joomla's update stream offers a Joomla 3 site only the 3.x line, so no update shown in Joomla Admin will ever clear this. Switch off user uploads (enable_user_cp), or move the site to a Joomla version that can run the patched 6.x build.
Affected versions: < 4.0.0
Full advisory: our disclosure post
Phoca Download - Phoca Download (com_phocadownload) 4.x - Authenticated Arbitrary File Upload (RCE), no fixed 4.x release
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Phoca fixed this on the 6.x branch only, in 6.1.3 (10 Jul 2026). The Joomla 4 line stops at 4.0.9 (28 Oct 2023) and still holds the vulnerable code: both File::upload() calls pass allow_unsafe=true and the front-end gate is still the pre-fix $frontEnd == 1 test. Verified on 27 Aug 2026 by diffing the released com_phocadownload zips. Joomla's update stream offers a Joomla 4 site only the 4.x line, so no update shown in Joomla Admin will ever clear this. Switch off user uploads (enable_user_cp), or move the site to a Joomla version that can run the patched 6.x build.
Affected versions: ≥ 4.0.0 and < 5.0.0
Full advisory: our disclosure post
Phoca Download - Phoca Download (com_phocadownload) 5.x - Authenticated Arbitrary File Upload (RCE), no fixed 5.x release
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Phoca fixed this on the 6.x branch only, in 6.1.3 (10 Jul 2026). The Joomla 5 line stops at 5.1.3 (22 Aug 2025) and still holds the vulnerable code: both File::upload() calls pass allow_unsafe=true and the front-end gate is still the pre-fix $frontEnd == 1 test. Verified on 27 Aug 2026 by diffing the released com_phocadownload zips. 5.1.3 is the newest build Joomla will offer a Joomla 5 site, so no update shown in Joomla Admin will ever clear this, and being fully up to date on the 5.x line does not make the site safe. Switch off user uploads (enable_user_cp), or move the site to a Joomla version that can run the patched 6.x build.
Affected versions: ≥ 5.0.0 and < 6.0.0
Full advisory: our disclosure post
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 14 September 2026.