Affected versions: ≥ 5.0.0 and < 5.8.1
Full advisory: our disclosure post
CVE-2026-60025HighCVSS 8.8CVE published 17 July 2026Added to mySites.guru 15 July 2026
Events Booking (com_eventbooking) 5.x below 5.8.1 - Unauthenticated File Upload and User Enumeration
Events Booking for Joomla 4/5/6 before 5.8.1 is affected by three vulnerabilities found by mySites.guru and assigned via the Joomla CNA. CVE-2026-60024: the front-end file upload endpoint was enabled by default on every install and accepted files from unauthenticated visitors. CVE-2026-60025: that same endpoint had no CSRF token check. CVE-2026-58149: a public endpoint returned any Joomla user name and email address for a supplied user ID with no ownership check, allowing an anonymous visitor to enumerate the entire user table. A matching download endpoint also served any file with an image extension back to anonymous callers, so uploaded content could be retrieved by anyone. JoomDonation fixed the three reported flaws in 5.8.0, but 5.8.0 was rebuilt and re-published under the same version number on 15 July 2026, so a site reporting 5.8.0 cannot be assumed to hold the later build, and all of the upload hardening (per-field permission checks, per-session and per-minute rate limits, folder size and file count caps, real image content validation, randomised filenames) only arrived in 5.8.1. Update to 5.8.1 or later. Joomla 3 sites are covered by a separate rule and must go to 4.9.5.
Is my site affected?
CVE-2026-60025 is checked by 2 rules. Find the extension and release line your site runs:
| Extension | Affected versions | Fixed in | What to do |
|---|---|---|---|
| Events Booking | from 5.0.0 up to but not including 5.8.1 | 5.8.1 | Update Events Booking to 5.8.1 for this flaw, or to 5.8.2 or later, which no rule we check matches. |
| Events Booking | before 4.9.5 | 4.9.5 | Update Events Booking to 4.9.5 or later. |
How CVE-2026-60025 is scored
The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw.
8.8 High
CVSS 3.1, scored by CISA-ADPCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HHow it is reached
- AV:N Attack vector
- Network. Reachable across the internet
- AC:L Attack complexity
- Low. Nothing to work around, it just works
- PR:N Privileges required
- None. No account needed
- UI:R User interaction
- Required. Someone has to click or visit something
- S:U Scope
- Unchanged. Contained to the extension it is in
What it does
- C:H Confidentiality
- High. Everything the site holds can be read
- I:H Integrity
- High. Data and files can be altered at will
- A:H Availability
- High. The site can be taken down
The rule below is rated Critical for the set of 3 CVEs it covers together, not for this record on its own.
Timeline
- 15 July 2026mySites.guru check added for Events Booking (from 5.0.0 up to but not including 5.8.1)
- 15 July 2026mySites.guru check added for Events Booking (before 4.9.5)
- 17 July 2026CVE-2026-60025 record published by its CNA
- 20 July 2026We published: Events Booking for Joomla: Anyone Could Upload Files to Your Server
Rule details
Events Booking - Events Booking (com_eventbooking) below 4.9.5 - Unauthenticated File Upload and User Enumeration
Joomla 3 branch of Events Booking. Versions below 4.9.5 are affected by the same three vulnerabilities found by mySites.guru and assigned via the Joomla CNA: an unauthenticated front-end file upload enabled by default (CVE-2026-60024), no CSRF token on that endpoint (CVE-2026-60025), and unauthenticated user enumeration returning any user name and email address for a supplied user ID (CVE-2026-58149). JoomDonation released 4.9.5 on 15 July 2026 as the Joomla 3 fix. It is NOT published in the JoomDonation downloads area: configure a Download ID and use Joomla's own updater, or open a support ticket to request the package. Sites on the Joomla 4/5/6 line are covered by a separate rule and must go to 5.8.1.
Affected versions: < 4.9.5
Full advisory: our disclosure post
Our disclosure post
Other vulnerabilities in Events Booking
Updating for CVE-2026-60025 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension.
Events Booking
Latest safe version: 5.8.2
- CVE-2026-58149 Critical, from 5.0.0 up to but not including 5.8.1
- CVE-2026-60024 Critical, from 5.0.0 up to but not including 5.8.1
- CVE-2026-63047 Medium, from 5.0.0 up to but not including 5.8.2
References
- CVE-2026-60025 on cve.org (the official CVE record)
- CVE-2026-60025 in the NIST National Vulnerability Database
- Events Booking for Joomla: Anyone Could Upload Files to Your Server
CVE-2026-60025 questions
Which versions are affected by CVE-2026-60025?
CVE-2026-60025 is covered by 2 rules: Events Booking from 5.0.0 up to but not including 5.8.1; Events Booking before 4.9.5.
How do I fix CVE-2026-60025?
It depends on the extension and release line your site runs. For Events Booking from 5.0.0 up to but not including 5.8.1: update Events Booking to 5.8.1 for this flaw, or to 5.8.2 or later, which no rule we check matches. For Events Booking before 4.9.5: update Events Booking to 4.9.5 or later.
How severe is CVE-2026-60025?
CISA-ADP scores it 8.8 (High) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and someone has to click or visit something.
Running an affected version on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
Rules current as of 5 October 2026.