Skip to main content
mySites.guru
Free Audit
CriticalPHP2Shell is fixed, but a researcher now claims six more unpatched PHP flaws. Nothing to do today, but PHP is not out of the woodsWhat to prepare

Easy Folder Listing Pro security vulnerabilities

mySites.guru tracks 2 vulnerabilities in Easy Folder Listing Pro (com_easyfolderlistingpro), covering 1 CVE. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs Easy Folder Listing Pro in any of these ranges:

  • from 4.4 up to but not including 4.5
  • from 3.7 up to but not including 3.8
Latest safe version
4.5 or later. No rule we check matches that release or any newer one.
What to do
Update Easy Folder Listing Pro to 4.5 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every Easy Folder Listing Pro vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2024-11145CVSS 9.3from 3.7 up to but not including 3.83.8Critical2024-11-26
CVE-2024-11145CVSS 9.3from 4.4 up to but not including 4.54.5Critical2024-11-26

What we check for

CriticalCVE-2024-111452024-11-26

Easy Folder Listing Pro (com_easyfolderlistingpro) 3.7 - Unauthenticated Deserialization Remote Code Execution (CVE-2024-11145)

Valor Apps Easy Folder Listing Pro contains a deserialization flaw that lets an unauthenticated remote attacker execute arbitrary code with the privileges of the Joomla application. CVSS 9.8 (Critical). This row covers the 3.x branch: update to 3.8 or later. The 4.x branch is affected separately at 4.4 and is covered by its own rule, because the two branches were fixed at different version numbers and one range cannot span both.

Affected versions: ≥ 3.7 and < 3.8

Full advisory: www.valorapps.com

CriticalCVE-2024-111452024-11-26

Easy Folder Listing Pro (com_easyfolderlistingpro) 4.4 - Unauthenticated Deserialization Remote Code Execution (CVE-2024-11145)

Valor Apps Easy Folder Listing Pro contains a deserialization flaw that lets an unauthenticated remote attacker execute arbitrary code with the privileges of the Joomla application. CVSS 9.8 (Critical). This row covers the 4.x branch: update to 4.5 or later. The 3.x branch is affected separately at 3.7 and is covered by its own rule, because the two branches were fixed at different version numbers and one range cannot span both.

Affected versions: ≥ 4.4 and < 4.5

Full advisory: www.valorapps.com

Timeline

  1. 26 November 2024Check added for CVE-2024-11145 (from 3.7 up to but not including 3.8)
  2. 26 November 2024Check added for CVE-2024-11145 (from 4.4 up to but not including 4.5)
  3. 26 November 2024CVE-2024-11145 record published

References

Each CVE page above links its official cve.org record and its NVD entry.

Easy Folder Listing Pro vulnerability questions

Which versions of Easy Folder Listing Pro are vulnerable?
mySites.guru tracks 2 vulnerabilities in Easy Folder Listing Pro (com_easyfolderlistingpro). A site is affected if its installed version is in any of these ranges: from 4.4 up to but not including 4.5; from 3.7 up to but not including 3.8.
What is the latest safe version of Easy Folder Listing Pro?
4.5. Every vulnerability tracked here is fixed by 4.5, and no rule we check matches that release or any later one.
How do I check which version of Easy Folder Listing Pro my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_easyfolderlistingpro. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running Easy Folder Listing Pro on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2024-11145. Rules current as of 25 October 2026.