DJ-Classifieds (com_djclassifieds) below 3.11.2 - Unauthenticated Arbitrary File Upload

DJ-Classifieds by DJ-Extensions, all versions before 3.11.2, exposes a front-end file upload endpoint (task=imageupload) that requires no login and validates no CSRF token. An anonymous visitor can write an attacker-named file into the component upload directory, which on a default install is served over the web. Several mitigations were already present in older builds and do reduce the impact: an extension blacklist rejects .php, .phtml, .sh and .js, uploaded content is scanned for patterns such as "<?php", "eval(" and "base64", image extensions are validated with getimagesize(), and temporary files are cleaned up after roughly 12 hours. The content scan only matches the literal "<?php" opening tag, so a short-tag payload ("<?=") survives it, which leaves a polyglot image webshell stored intact and executable on permissive hosts or through a local file inclusion chain. Version 3.11.2 (released 20 July 2026) adds authentication and CSRF/session checks to the imageupload endpoint and enforces a server-side image-only whitelist. Update to 3.11.2 or later. If you cannot update immediately, block POST requests to index.php?option=com_djclassifieds&task=imageupload at the web server or WAF, and check the component upload directory for files you do not recognise. This range also covers the earlier authenticated SQL injection fixed in 3.10.2 (CVE-2025-54474).

Affected versions: < 3.11.2

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions