Skip to main content
mySites.guru
Free Audit
J!Awards 2026mySites.guru is shortlisted for Your Favourite Tool in Your Joomla WorkflowVote by 11 OctoberHow to vote
CVE-2026-57832HighCVSS 8.7CVE published 15 July 2026Added to mySites.guru 14 July 2026

EDocman (com_edocman) below 3.9 - Unauthenticated SQL Injection (full database read)

A public front-end endpoint in EDocman (the document and download manager for Joomla by JoomDonation) placed a request parameter into a database query without sanitising it, an unauthenticated SQL injection (CWE-89). An anonymous visitor, with no login, no CSRF token and no user interaction, could read data from any table in the site database in a single request: user accounts, bcrypt password hashes, password reset tokens and the Joomla secret. Both error-based (fast) and time-based blind extraction work. Where the site connects to MySQL with a privileged account, the read reaches every database on that server, not just this site. mySites.guru discovered and reported this privately; JoomDonation fixed it in EDocman 3.9 (released 14 July 2026). Affects 3.8 and earlier. Update to 3.9 or later immediately. Interim mitigation: a web application firewall with SQL injection filtering enabled can block many attempts, but it is mitigation, not a fix. CVSS 4.0 8.7 (High), our own assessment; CVE pending via the Joomla CNA.

Is my site affected?

Affected
EDocman before 3.9
Fixed in
3.9
What to do
Update EDocman to 3.9 or later.
Check whether your sites are affected

How CVE-2026-57832 is scored

The base metrics as Joomla CNA published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.

8.7 High

CVSS 4.0, scored by Joomla CNA
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N

How it is reached

AV:N Attack vector
Network. Reachable across the internet
AC:L Attack complexity
Low. Nothing to work around, it just works
AT:N Attack requirements
None. Works against any affected install
PR:N Privileges required
None. No account needed
UI:N User interaction
None. Nobody has to be tricked into anything

What it does to the site

VC:H Confidentiality
High. Everything the site holds can be read
VI:N Integrity
None. Nothing can be altered
VA:N Availability
None. The site stays up

What it does beyond the site

SC:N Confidentiality
None. Other systems keep their data
SI:N Integrity
None. Other systems keep their integrity
SA:N Availability
None. Other systems stay up

mySites.guru rates this Critical. Where our assessment and the published record differ, your sites are checked against ours.

Timeline

  1. 14 July 2026mySites.guru check added for EDocman (before 3.9)
  2. 14 July 2026We published: Unauthenticated SQL Injection in EDocman found by mySites.guru
  3. 15 July 2026CVE-2026-57832 record published by its CNA

Rule details

Our disclosure post

Unauthenticated SQL Injection in EDocman found by mySites.guru

Unauthenticated SQL Injection in EDocman found by mySites.guru

mySites.guru found an unauthenticated SQL injection in EDocman for Joomla that let anyone read the whole database. Fixed in 3.9.0 - update now.

Other vulnerabilities in EDocman

Updating for CVE-2026-57832 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.

EDocman

Latest safe version: 3.9

References

CVE-2026-57832 questions

Which versions are affected by CVE-2026-57832?
CVE-2026-57832 affects EDocman before 3.9. The fix is in 3.9.
How do I fix CVE-2026-57832?
Update EDocman to 3.9 or later. Then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
How severe is CVE-2026-57832?
Joomla CNA scores it 8.7 (High) under CVSS 4.0. In plain terms: reachable across the internet, no account needed and nobody has to be tricked into anything.

Running an affected version on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

Rules current as of 5 October 2026.