Skip to main content
mySites.guru
Free Audit
CriticalA PHP security release fixes two CVSS 9.2 flaws, and PHP 8.1 and older get no patchWhat it means for your site

EDocman security vulnerabilities

mySites.guru tracks 1 vulnerability in EDocman (com_edocman), covering 1 CVE. Every connected Joomla site is checked against it on each audit.

Is my site affected?

Your site is affected if it runs EDocman in this range:

  • before 3.9
Latest safe version
3.9 or later. No rule we check matches that release or any newer one.
What to do
Update EDocman to 3.9 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every EDocman vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-57832CVSS 8.7before 3.93.9Critical2026-07-14

What we check for

CriticalCVE-2026-578322026-07-14

EDocman (com_edocman) below 3.9 - Unauthenticated SQL Injection (full database read)

A public front-end endpoint in EDocman (the document and download manager for Joomla by JoomDonation) placed a request parameter into a database query without sanitising it, an unauthenticated SQL injection (CWE-89). An anonymous visitor, with no login, no CSRF token and no user interaction, could read data from any table in the site database in a single request: user accounts, bcrypt password hashes, password reset tokens and the Joomla secret. Both error-based (fast) and time-based blind extraction work. Where the site connects to MySQL with a privileged account, the read reaches every database on that server, not just this site. mySites.guru discovered and reported this privately; JoomDonation fixed it in EDocman 3.9 (released 14 July 2026). Affects 3.8 and earlier. Update to 3.9 or later immediately. Interim mitigation: a web application firewall with SQL injection filtering enabled can block many attempts, but it is mitigation, not a fix. CVSS 4.0 8.7 (High), our own assessment; CVE pending via the Joomla CNA.

Affected versions: < 3.9

Full advisory: our disclosure post

Timeline

  1. 14 July 2026Check added for CVE-2026-57832 (before 3.9)
  2. 14 July 2026We published: Unauthenticated SQL Injection in EDocman found by mySites.guru
  3. 15 July 2026CVE-2026-57832 record published

What we have written about EDocman

Unauthenticated SQL Injection in EDocman found by mySites.guru

Unauthenticated SQL Injection in EDocman found by mySites.guru

mySites.guru found an unauthenticated SQL injection in EDocman for Joomla that let anyone read the whole database. Fixed in 3.9.0 - update now.

References

Each CVE page above links its official cve.org record and its NVD entry.

EDocman vulnerability questions

Which versions of EDocman are vulnerable?
mySites.guru tracks one vulnerability in EDocman (com_edocman). A site is affected if its installed version is in this range: before 3.9.
What is the latest safe version of EDocman?
3.9. Every vulnerability tracked here is fixed by 3.9, and no rule we check matches that release or any later one.
How do I check which version of EDocman my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_edocman. mySites.guru reads the installed version on every audit of a connected site and checks it against this rule.

Running EDocman on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-57832. Rules current as of 25 October 2026.