Affected versions: < 3.9
Full advisory: our disclosure post
CVE-2026-57832CriticalPublished 14 July 2026
EDocman (com_edocman) below 3.9 - Unauthenticated SQL Injection (full database read)
A public front-end endpoint in EDocman (the document and download manager for Joomla by JoomDonation) placed a request parameter into a database query without sanitising it, an unauthenticated SQL injection (CWE-89). An anonymous visitor, with no login, no CSRF token and no user interaction, could read data from any table in the site database in a single request: user accounts, bcrypt password hashes, password reset tokens and the Joomla secret. Both error-based (fast) and time-based blind extraction work. Where the site connects to MySQL with a privileged account, the read reaches every database on that server, not just this site. mySites.guru discovered and reported this privately; JoomDonation fixed it in EDocman 3.9 (released 14 July 2026). Affects 3.8 and earlier. Update to 3.9 or later immediately. Interim mitigation: a web application firewall with SQL injection filtering enabled can block many attempts, but it is mitigation, not a fix. CVSS 4.0 8.7 (High), our own assessment; CVE pending via the Joomla CNA.
Affected versions: < 3.9
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.