Affected versions: < 6.1.3
Full advisory: our disclosure post
CVE-2026-57828CriticalPublished 10 July 2026
Phoca Download (com_phocadownload) below 6.1.3 - Authenticated Arbitrary File Upload (RCE)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Fixed in 6.1.3 (10 Jul 2026), which enforces the allow-list on the member-upload path. Update to 6.1.3 or later; if you cannot, switch off user uploads (enable_user_cp).
Affected versions: < 6.1.3
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.