Event Gallery (com_eventgallery) below 6.5.0 - Authenticated Path Traversal Folder Deletion, CSRF Image Upload and Overwrite, Reflected XSS and Guessable Order IDs
Event Gallery (Core and Extended) versions before 6.5.0 contain several security flaws, fixed by the vendor in 6.5.0 (26 September 2026) and published by the Joomla CNA as five CVEs on 27 September 2026, each listing 1.0.0 to 6.0.0 as affected. 1) CVE-2026-97164 (CVSS 4.0 7.0 High, vendor advisory EGSA-2026-01): path traversal in the Clear Cache task. A backend user allowed to manage Event Gallery (by default every Administrator, not only Super Users) could use the images parameter of the cache.process task to recursively delete any folder the web server can write to, up to the whole site. 2) CVE-2026-97165 (5.3 Medium, EGSA-2026-02): the Back link of the frontend upload page base64-decoded its return parameter and printed it unvalidated, allowing a crafted link to redirect an editor to another site or run script in their session (reflected XSS and open redirect); the page also printed the event folder name unescaped. 3) CVE-2026-100747 (5.1 Medium, EGSA-2026-03): the upload task in both the backend and the frontend did not check the Joomla form token, so a page on another website could make a logged-in editor or frontend publisher upload images into an event and replace existing images of the same name. Uploads remain restricted to jpg, gif, png, webp and mp4 files with a matching MIME type, so this is a content-integrity attack rather than code execution. 4) CVE-2026-100748 (6.9 Medium, EGSA-2026-04): adding and removing cart items needed no token, so another site could change a visitor's cart. 5) CVE-2026-100749 (5.1 Medium, EGSA-2026-05): the backend clean-up links (orphaned file entries, carts older than 30 days) had no token check. Also hardened in 6.5.0 without a CVE: the email template test-mail button, the Sync Database and Thumbnail Creator tools and three backend AJAX requests lacked token or permission checks, and cart and order identifiers were derived only from the creation timestamp, so anyone knowing roughly when an order was placed could work out its identifier (download links were protected by a separate random token). Update to Event Gallery 6.5.0 or later (it requires Joomla 5.4 or Joomla 6). Carts and orders created before the update keep their old, guessable identifiers. If you override the backend or frontend upload layout (upload/default.php) in your template, update the override, as the upload now requires the token. Until you can update, restrict who has manage and edit permission on Event Gallery.
Affected versions: < 6.5.0
Full advisory: our disclosure post
