ZOO (com_zoo) below 4.1.64 - Unauthenticated Arbitrary File Upload (RCE, CVSS 10.0), Unauthenticated SQL Injection (CVSS 9.3) and Open Redirect

YOOtheme ZOO (com_zoo) up to and including 4.1.63 contains three unauthenticated vulnerabilities, all fixed in 4.1.64 released on 19 August 2026, and all published as CVEs by the Joomla CNA on 19 August 2026. All three were found and reported by Phil Taylor of mySites.guru, who is credited as finder on each record. Every one was proved live on a test install, not inferred from reading code. 1) Unauthenticated arbitrary file upload leading to remote code execution (CVE-2026-74803, CWE-434, CVSS 4.0 base 10.0 Critical, AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The Image element used in ZOO front-end submission forms validates uploads against the client-supplied Content-Type header only. It never inspects the file contents and sets no extension allow-list, and the filename passes through Joomla File::makeSafe, which preserves a .php extension. An anonymous visitor can therefore submit a PHP file declared as image/jpeg and have it written into images/zoo/uploads/ inside the web root, where the web server executes it. That is a full remote code execution with no login, no CSRF obstacle and no user interaction. Guest access to submissions is the ZOO default and captcha is off by default. A proof-of-concept shell uploaded this way executed on the test host. 2) Unauthenticated SQL injection (CVE-2026-74804, CWE-89, CVSS 4.0 base 9.3 Critical). ItemController::element() interpolates the filter_type request value straight into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting and no escaping. An anonymous request to index.php?option=com_zoo&app_id=<id>&controller=item&task=element can break out of the string, bypass the published-state and view-access filters to read unpublished and access-restricted items, and use a UNION to read arbitrary data from the database. Exfiltration of the MySQL version and the database name was demonstrated as an unauthenticated guest. 3) Open redirect (CVE-2026-75114, CWE-601, CVSS 4.0 base 5.1 Medium). CommentController::twitterAuthenticate() passes the referer request parameter directly to setRedirect() with no scheme or host validation, so the site issues an HTTP 303 to any attacker-chosen destination. It works whether or not Twitter authentication is configured, and gives phishing campaigns a redirect through a trusted domain. Update to ZOO 4.1.66 or later now - 4.1.64 fixed these three findings, but 4.1.65 and 4.1.66 each fixed further ones, so 4.1.66 is the minimum safe version. Until you can: remove the Image element from any published front-end submission form, or restrict those forms so guests cannot reach them, and audit images/zoo/uploads/ for anything that is not an image. Because the upload flaw needs no login, any site that ran a vulnerable version while internet-facing should be treated as potentially compromised until checked - look for .php files anywhere under images/, for administrator accounts you do not recognise, and consider rotating the Joomla secret and stored credentials. Two further releases followed. 4.1.65 completed the tag-management authorisation fix, published as CVE-2026-76610 (CVSS 6.9). 4.1.66, on 21 August 2026, fixed three more published CVEs on the front-end submission path (CVE-2026-76611 arbitrary directory listing, CVE-2026-77028 reflected XSS and open redirect, CVE-2026-77029 missing CSRF protection) plus two unannounced hardening fixes on the same upload path that produced the RCE. All of these are also credited to Phil Taylor of mySites.guru. The minimum safe version is 4.1.66.

Affected versions: < 4.1.64

Official record: cve.org · NVD

Every connected Joomla site is checked against this rule on each audit, and flagged if it runs an affected version.

Affected extensions and versions