jDownloads (com_jdownloads) 4.1.0 to 4.1.5 - Unauthenticated Arbitrary File Upload (malware hosting, RCE on misconfigured hosts)

jDownloads 4.1.0 to 4.1.5 ship a standalone, unauthenticated file-upload handler at administrator/components/com_jdownloads/assets/upload/upload-handler.php. The handler was introduced in the 4.1.0 release and is absent from 4.0.52 and earlier. The vendor confirms it was a test/experimental upload component unintentionally included in the release package. The endpoint has no _JEXEC guard, no Joomla session, no CSRF token and no permission check, and it bypasses jDownloads' own upload blacklist - it enforces only its own hardcoded extension allow-list (zip, rar, 7z, tar, gz, pdf, exe, msi, dat, mp3, mp4, images and Office documents). An unauthenticated attacker can POST arbitrary files of those types to a web-accessible directory and read them back over HTTP: malware/phishing hosting on the trusted domain and storage/disk abuse (default 500MB per file). It becomes remote code execution on any host that executes secondary file extensions (Apache AddHandler/mod_mime), or if an administrator has added an executable type (php/phtml) to the allowed list. Confirmed exploitable live (unauthenticated upload plus public read-back) on a default install. As of 2026-07-17 no fixed release is published (4.1.5 is current); the vendor's prepared fix removes the handler and the residual test_uploads directory on update. Mitigation until then: delete administrator/components/com_jdownloads/assets/upload/upload-handler.php and the administrator/components/com_jdownloads/test_uploads/ directory if present, or block web access to that path.

Affected versions: ≥ 4.1.0 and ≤ 4.1.5

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions