Easy Folder Listing Pro security vulnerabilities

mySites.guru tracks 2 vulnerabilities in com_easyfolderlistingpro. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.

Check whether your sites are affected

What we check for

CriticalCVE-2024-111452024-11-26

Easy Folder Listing Pro (com_easyfolderlistingpro) 3.7 - Unauthenticated Deserialization Remote Code Execution (CVE-2024-11145)

Valor Apps Easy Folder Listing Pro contains a deserialization flaw that lets an unauthenticated remote attacker execute arbitrary code with the privileges of the Joomla application. CVSS 9.8 (Critical). This row covers the 3.x branch: update to 3.8 or later. The 4.x branch is affected separately at 4.4 and is covered by its own rule, because the two branches were fixed at different version numbers and one range cannot span both.

Affected versions: ≥ 3.7 and < 3.8

Full advisory: www.valorapps.com

CriticalCVE-2024-111452024-11-26

Easy Folder Listing Pro (com_easyfolderlistingpro) 4.4 - Unauthenticated Deserialization Remote Code Execution (CVE-2024-11145)

Valor Apps Easy Folder Listing Pro contains a deserialization flaw that lets an unauthenticated remote attacker execute arbitrary code with the privileges of the Joomla application. CVSS 9.8 (Critical). This row covers the 4.x branch: update to 4.5 or later. The 3.x branch is affected separately at 3.7 and is covered by its own rule, because the two branches were fixed at different version numbers and one range cannot span both.

Affected versions: ≥ 4.4 and < 4.5

Full advisory: www.valorapps.com

Running Easy Folder Listing Pro on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

CVE identifiers: CVE-2024-11145. Rules current as of 13 September 2026.