iCagenda (com_icagenda) below 4.0.8 - Unauthenticated Arbitrary File Upload (RCE) (CVE-2026-48939, CISA KEV)
Affected versions: ≥ 4.0.0 and < 4.0.8
iCagenda security vulnerabilities
mySites.guru tracks 3vulnerabilities in com_icagenda. Every connected Joomla site is checked against them on each audit, and flagged if it runs an affected version.
What we check for
iCagenda (com_icagenda) below 4.0.8 - Unauthenticated Arbitrary File Upload (RCE) (CVE-2026-48939, CISA KEV)
Affected versions: ≥ 3.2.1 and < 3.9.15
iCagenda (com_icagenda) 4.0.8 to 4.0.11 - Unauthenticated SQL Injection (CVE-2026-67365)
Affected versions: ≥ 4.0.8 and < 4.0.12
What we have written about iCagenda
iCagenda 4.0.12 fixes an unauthenticated SQL injection
CVE-2026-67365 is an unauthenticated SQL injection in the iCagenda Calendar module for Joomla, scored 9.2 Critical. Fixed in 4.0.12.
Zero Day Vulnerability Found in iCagenda Joomla Extension
We found and confirmed an unauthenticated file upload that gave attackers full remote code execution on Joomla 6 sites running iCagenda. It was already being exploited. The developer shipped 4.0.8 the same day.
Running iCagenda on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-48939. Rules current as of 24 August 2026.