# Events Booking (com_eventbooking) 5.x below 5.8.1 - Unauthenticated File Upload and User Enumeration [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/CVE-2026-60025 CVE-2026-60025HighCVSS 8.8CVE published 17 July 2026Added to mySites.guru 15 July 2026 # Events Booking (com\_eventbooking) 5.x below 5.8.1 - Unauthenticated File Upload and User Enumeration Events Booking for Joomla 4/5/6 before 5.8.1 is affected by three vulnerabilities found by mySites.guru and assigned via the Joomla CNA. CVE-2026-60024: the front-end file upload endpoint was enabled by default on every install and accepted files from unauthenticated visitors. CVE-2026-60025: that same endpoint had no CSRF token check. CVE-2026-58149: a public endpoint returned any Joomla user name and email address for a supplied user ID with no ownership check, allowing an anonymous visitor to enumerate the entire user table. A matching download endpoint also served any file with an image extension back to anonymous callers, so uploaded content could be retrieved by anyone. JoomDonation fixed the three reported flaws in 5.8.0, but 5.8.0 was rebuilt and re-published under the same version number on 15 July 2026, so a site reporting 5.8.0 cannot be assumed to hold the later build, and all of the upload hardening (per-field permission checks, per-session and per-minute rate limits, folder size and file count caps, real image content validation, randomised filenames) only arrived in 5.8.1. Update to 5.8.1 or later. Joomla 3 sites are covered by a separate rule and must go to 4.9.5. Copy citation ## Is my site affected? CVE-2026-60025 is checked by 2 rules. Find the extension and release line your site runs: Extension Affected versions Fixed in What to do [Events Booking](https://mysites.guru/vulnerabilities/eventbooking/) from 5.0.0 up to but not including 5.8.1 5.8.1 Update Events Booking to 5.8.1 for this flaw, or to 5.8.2 or later, which no rule we check matches. [Events Booking](https://mysites.guru/vulnerabilities/eventbooking/) before 4.9.5 4.9.5 Update Events Booking to 4.9.5 or later. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## How CVE-2026-60025 is scored The base metrics as CISA-ADP published them, and what each one means for a site running an affected version. Threat and environmental metrics are left out: they describe a moment or a particular install rather than the flaw. 8.8 High CVSS 3.1, scored by CISA-ADP `CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H` ### How it is reached - **AV:N Attack vector** - Network. Reachable across the internet - **AC:L Attack complexity** - Low. Nothing to work around, it just works - **PR:N Privileges required** - None. No account needed - **UI:R User interaction** - Required. Someone has to click or visit something - **S:U Scope** - Unchanged. Contained to the extension it is in ### What it does - **C:H Confidentiality** - High. Everything the site holds can be read - **I:H Integrity** - High. Data and files can be altered at will - **A:H Availability** - High. The site can be taken down The rule below is rated Critical for the set of 3 CVEs it covers together, not for this record on its own. ## Timeline 1. 15 July 2026mySites.guru check added for Events Booking (from 5.0.0 up to but not including 5.8.1) 2. 15 July 2026mySites.guru check added for Events Booking (before 4.9.5) 3. 17 July 2026CVE-2026-60025 record published by its CNA 4. 20 July 2026[We published: Events Booking for Joomla: Anyone Could Upload Files to Your Server](https://mysites.guru/blog/events-booking-unauthenticated-upload-user-enumeration/) ## Rule details Critical[CVE-2026-58149](https://mysites.guru/vulnerabilities/CVE-2026-58149/)[CVE-2026-60024](https://mysites.guru/vulnerabilities/CVE-2026-60024/)[CVE-2026-60025](https://mysites.guru/vulnerabilities/CVE-2026-60025/)2026-07-15 [Events Booking](https://mysites.guru/vulnerabilities/eventbooking/) Affected versions: ≥ 5.0.0 and < 5.8.1 Full advisory: [our disclosure post](https://mysites.guru/blog/events-booking-unauthenticated-upload-user-enumeration/) Critical[CVE-2026-58149](https://mysites.guru/vulnerabilities/CVE-2026-58149/)[CVE-2026-60024](https://mysites.guru/vulnerabilities/CVE-2026-60024/)[CVE-2026-60025](https://mysites.guru/vulnerabilities/CVE-2026-60025/)2026-07-15 [Events Booking](https://mysites.guru/vulnerabilities/eventbooking/) - Events Booking (com\_eventbooking) below 4.9.5 - Unauthenticated File Upload and User Enumeration Joomla 3 branch of Events Booking. Versions below 4.9.5 are affected by the same three vulnerabilities found by mySites.guru and assigned via the Joomla CNA: an unauthenticated front-end file upload enabled by default (CVE-2026-60024), no CSRF token on that endpoint (CVE-2026-60025), and unauthenticated user enumeration returning any user name and email address for a supplied user ID (CVE-2026-58149). JoomDonation released 4.9.5 on 15 July 2026 as the Joomla 3 fix. It is NOT published in the JoomDonation downloads area: configure a Download ID and use Joomla's own updater, or open a support ticket to request the package. Sites on the Joomla 4/5/6 line are covered by a separate rule and must go to 5.8.1. Affected versions: < 4.9.5 Full advisory: [our disclosure post](https://mysites.guru/blog/events-booking-unauthenticated-upload-user-enumeration/) ## Our disclosure post [![Events Booking for Joomla: Anyone Could Upload Files to Your Server](https://mysites.guru/_astro/events-booking-unauthenticated-upload-user-enumeration.fDQsCHa8_ZXusrX.webp) ### Events Booking for Joomla: Anyone Could Upload Files to Your Server mySites.guru found two unauthenticated flaws in Events Booking for Joomla: file upload enabled by default, and a leak of every user's name and email. 20 Jul 2026 ](https://mysites.guru/blog/events-booking-unauthenticated-upload-user-enumeration/) ## Other vulnerabilities in Events Booking Updating for CVE-2026-60025 alone can leave a site on a release another rule still matches. These are the other flaws we check for in the same extension. ### [Events Booking](https://mysites.guru/vulnerabilities/eventbooking/) Latest safe version: 5.8.2 - [CVE-2026-58149](https://mysites.guru/vulnerabilities/CVE-2026-58149/) Critical, from 5.0.0 up to but not including 5.8.1 - [CVE-2026-60024](https://mysites.guru/vulnerabilities/CVE-2026-60024/) Critical, from 5.0.0 up to but not including 5.8.1 - [CVE-2026-63047](https://mysites.guru/vulnerabilities/CVE-2026-63047/) Medium, from 5.0.0 up to but not including 5.8.2 ## References - [CVE-2026-60025 on cve.org (the official CVE record)](https://www.cve.org/CVERecord?id=CVE-2026-60025) - [CVE-2026-60025 in the NIST National Vulnerability Database](https://nvd.nist.gov/vuln/detail/CVE-2026-60025) - [Events Booking for Joomla: Anyone Could Upload Files to Your Server](https://mysites.guru/blog/events-booking-unauthenticated-upload-user-enumeration/) ## CVE-2026-60025 questions Show all Which versions are affected by CVE-2026-60025? [CVE-2026-60025](https://mysites.guru/vulnerabilities/CVE-2026-60025/) is covered by 2 rules: Events Booking from 5.0.0 up to but not including 5.8.1; Events Booking before 4.9.5. How do I fix CVE-2026-60025? It depends on the extension and release line your site runs. For Events Booking from 5.0.0 up to but not including 5.8.1: update Events Booking to 5.8.1 for this flaw, or to 5.8.2 or later, which no rule we check matches. For Events Booking before 4.9.5: update Events Booking to 4.9.5 or later. How severe is CVE-2026-60025? CISA-ADP scores it 8.8 (High) under CVSS 3.1. In plain terms: reachable across the internet, no account needed and someone has to click or visit something. ## Running an affected version on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). Rules current as of 14 October 2026.