Affected versions: ≥ 5.0.0 and < 5.8.1
Full advisory: our disclosure post
CVE-2026-60024CriticalPublished 15 July 2026
Events Booking (com_eventbooking) 5.x below 5.8.1 - Unauthenticated File Upload and User Enumeration
Events Booking for Joomla 4/5/6 before 5.8.1 is affected by three vulnerabilities found by mySites.guru and assigned via the Joomla CNA. CVE-2026-60024: the front-end file upload endpoint was enabled by default on every install and accepted files from unauthenticated visitors. CVE-2026-60025: that same endpoint had no CSRF token check. CVE-2026-58149: a public endpoint returned any Joomla user name and email address for a supplied user ID with no ownership check, allowing an anonymous visitor to enumerate the entire user table. A matching download endpoint also served any file with an image extension back to anonymous callers, so uploaded content could be retrieved by anyone. JoomDonation fixed the three reported flaws in 5.8.0, but 5.8.0 was rebuilt and re-published under the same version number on 15 July 2026, so a site reporting 5.8.0 cannot be assumed to hold the later build, and all of the upload hardening (per-field permission checks, per-session and per-minute rate limits, folder size and file count caps, real image content validation, randomised filenames) only arrived in 5.8.1. Update to 5.8.1 or later. Joomla 3 sites are covered by a separate rule and must go to 4.9.5.
Affected versions: ≥ 5.0.0 and < 5.8.1
Official record: cve.org · NVD
Related vulnerabilities
Every connected Joomla site is checked against these rules on each audit, and flagged if it runs an affected version.
Affected extensions and versions
Events Booking - Events Booking (com_eventbooking) below 4.9.5 - Unauthenticated File Upload and User Enumeration
Joomla 3 branch of Events Booking. Versions below 4.9.5 are affected by the same three vulnerabilities found by mySites.guru and assigned via the Joomla CNA: an unauthenticated front-end file upload enabled by default (CVE-2026-60024), no CSRF token on that endpoint (CVE-2026-60025), and unauthenticated user enumeration returning any user name and email address for a supplied user ID (CVE-2026-58149). JoomDonation released 4.9.5 on 15 July 2026 as the Joomla 3 fix. It is NOT published in the JoomDonation downloads area: configure a Download ID and use Joomla's own updater, or open a support ticket to request the package. Sites on the Joomla 4/5/6 line are covered by a separate rule and must go to 5.8.1.
Affected versions: < 4.9.5
Full advisory: our disclosure post
Our disclosure post
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
Rules current as of 25 August 2026.