Skip to main content
mySites.guru
5+ live

Joomla extension security alerts (22 Aug) Fabrik 4.7.2ZOO: unauth RCEPhoca Cart: unauth SQLiJCE 2.9.99.10SP Page Builder RCE

Astroid Framework security vulnerabilities

mySites.guru tracks 1vulnerability in astroid. Every connected Joomla site is checked against it on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

CriticalCVE-2026-216282026-03-05

Astroid Framework (astroid) 2.0.0 to 3.3.10 - Unauthenticated Arbitrary File Upload (RCE)

Affected versions: ≥ 2.0.0 and ≤ 3.3.10

What we have written about Astroid Framework

Astroid Framework Vulnerability - What Happened and How to Check Your Joomla Site

CVE-2026-21628 (CVSS 10.0) - Astroid Framework for Joomla had a critical auth bypass letting attackers upload backdoors. What happened and what to do.

Running Astroid Framework on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2026-21628. Rules current as of 24 August 2026.