Event Gallery (com_eventgallery) below 6.5.0 - CSRF Image Upload and Overwrite, Reflected XSS and Guessable Order IDs
Event Gallery (Core and Extended) versions before 6.5.0 contain several security flaws, fixed by the vendor in 6.5.0 (26 September 2026). No CVE has been assigned. The most serious: the upload task in both the backend and the frontend did not check the Joomla form token, so a page on another website could make a logged-in editor or frontend publisher silently upload images into an event and replace existing images of the same name (confirmed by diffing 5.7.8 and 6.0.0 against 6.5.0). Uploads remain restricted to jpg, gif, png, webp and mp4 files with a matching MIME type, so this is a content-integrity attack rather than code execution. The Back link of the frontend upload page printed its target straight from the URL, allowing a crafted link to redirect an editor to another site or run script in their session (reflected XSS), and the upload page printed the event folder name unescaped. The backend clean-up links (delete orphaned files, old carts), the test-mail button of email templates, the Sync Database, Thumbnail Creator and Clear Cache tools, and three backend AJAX requests either lacked the CSRF token check or did not check that the user may manage Event Gallery. Cart and order identifiers were derived only from the creation timestamp, so anyone knowing roughly when an order was placed could work out its identifier (download links were protected by a separate random token). Exploitation of the CSRF and XSS issues requires tricking a logged-in user into visiting an attacker page or link. Update to Event Gallery 6.5.0 or later. Note that carts and orders created before the update keep their old, guessable identifiers. If you override the backend or frontend upload layout (upload/default.php) in your template, update the override, as the upload now requires the token.
Affected versions: < 6.5.0
Full advisory: our disclosure post
