Skip to main content
mySites.guru
Free Audit
NewmySites.guru is now a Cloudflare verified serviceWhat it means for your sites

DJ-Classifieds security vulnerabilities

mySites.guru tracks 2 vulnerabilities in DJ-Classifieds (com_djclassifieds), covering 2 CVEs. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs DJ-Classifieds in any of these ranges:

  • before 3.11.3
  • before 3.11.2
Latest safe version
3.11.3 or later. No rule we check matches that release or any newer one.
What to do
Update DJ-Classifieds to 3.11.3 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every DJ-Classifieds vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
No CVE idbefore 3.11.33.11.3Critical2026-11-02
CVE-2026-61424CVSS 10.0CVE-2025-54474CVSS 8.5before 3.11.23.11.2Critical2026-07-20

What we check for

Critical2026-11-02

DJ-Classifieds (com_djclassifieds) below 3.11.3 - SQL Injection, Unrestricted Upload and Missing Ownership Checks

DJ-Classifieds 3.11.3, released on 2 November 2026, is a security release. The vendor changelog lists fixes for unrestricted uploads, SQL injection and missing ownership checks. Comparing the 3.11.2 and 3.11.3 code confirms: the djcf_latlon location cookie now reaches the distance search queries as a number rather than raw SQL; the advert save no longer accepts the item id and other server-controlled columns from the submitted form; profile, category and custom-field image uploads now check the real file type rather than the browser-sent type; payment, order, offer and advert-copy actions now verify the logged-in user owns the record; and the image rotate task is confined to the temporary upload folder. The bundled PayPal payment plugin was also hardened. No CVE has been assigned yet. Update every site to DJ-Classifieds 3.11.3. Sites still below 3.11.2 are additionally affected by the separate unauthenticated file upload fixed in 3.11.2 (CVE-2026-61424).

Affected versions: < 3.11.3

Full advisory: our disclosure post

CriticalCVE-2026-61424CVE-2025-544742026-07-20

DJ-Classifieds (com_djclassifieds) below 3.11.2 - Unauthenticated Arbitrary File Upload

DJ-Classifieds by DJ-Extensions, all versions before 3.11.2, exposes a front-end file upload endpoint (task=imageupload) that requires no login and validates no CSRF token. An anonymous visitor can write an attacker-named file into the component upload directory, which on a default install is served over the web. Several mitigations were already present in older builds and do reduce the impact: an extension blacklist rejects .php, .phtml, .sh and .js, uploaded content is scanned for patterns such as "<?php", "eval(" and "base64", image extensions are validated with getimagesize(), and temporary files are cleaned up after roughly 12 hours. The content scan only matches the literal "<?php" opening tag, so a short-tag payload ("<?=") survives it, which leaves a polyglot image webshell stored intact and executable on permissive hosts or through a local file inclusion chain. Version 3.11.2 (released 20 July 2026) adds authentication and CSRF/session checks to the imageupload endpoint and enforces a server-side image-only whitelist. Update to 3.11.2 or later. If you cannot update immediately, block POST requests to index.php?option=com_djclassifieds&task=imageupload at the web server or WAF, and check the component upload directory for files you do not recognise. This range also covers the earlier authenticated SQL injection fixed in 3.10.2 (CVE-2025-54474).

Affected versions: < 3.11.2

Full advisory: dj-extensions.com

Timeline

  1. 15 August 2025CVE-2025-54474 record published
  2. 20 July 2026Check added for CVE-2026-61424 and CVE-2025-54474 (before 3.11.2)
  3. 20 July 2026CVE-2026-61424 record published
  4. 2 November 2026Check added for a flaw with no CVE id (before 3.11.3)

References

Each CVE page above links its official cve.org record and its NVD entry.

DJ-Classifieds vulnerability questions

Which versions of DJ-Classifieds are vulnerable?
mySites.guru tracks 2 vulnerabilities in DJ-Classifieds (com_djclassifieds). A site is affected if its installed version is in any of these ranges: before 3.11.3; before 3.11.2.
What is the latest safe version of DJ-Classifieds?
3.11.3. Every vulnerability tracked here is fixed by 3.11.3, and no rule we check matches that release or any later one.
How do I check which version of DJ-Classifieds my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_djclassifieds. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running DJ-Classifieds on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-61424, CVE-2025-54474. Rules current as of 2 November 2026.