Is my site affected?
Your site is affected if it runs jDownloads in any of these ranges:
- before 4.1.8
- from 4.1.0 up to and including 4.1.5
- from 1.9.0 up to and including 4.0.47
- Latest safe version
- 4.1.8 or later. No rule we check matches that release or any newer one.
- What to do
- Update jDownloads to 4.1.8 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.
jDownloads (com_jdownloads) below 4.1.8 - RCE via Frontend Thumbnail Upload, Restricted File Download (IDOR), SSRF, Path Traversal and Unauthenticated Scan Key Disclosure
jDownloads 4.1.8 (12 November 2026) is a security release fixing nine issues reported by Lukasz Rybak and Fadilulah Ajeigbe and coordinated by the Joomla Security Strike Team. The Joomla CNA published five CVEs the same day, each stating jDownloads 1.0.0 to 4.1.7 as affected: CVE-2026-117551 (CVSS 4.0 10.0 Critical): insufficient validation of frontend thumbnail uploads let users with upload permission place executable files on the server, giving PHP code execution. CVE-2026-117543 (8.9 High): HTTP redirects when fetching external download URLs bypassed destination validation, allowing server-side requests to internal hosts and disclosure of the responses (SSRF). CVE-2026-117544 (8.2 High): the other_file_id parameter delivered another download's file without enforcing that download's access restrictions. CVE-2026-117550 (7.1 High): manipulated frontend submission values published submissions despite auto-publish being off and assigned ownership against policy. CVE-2026-117542 (5.1 Medium): a manipulated update_file parameter moved files from outside the permitted server-file folder into a download. Without a CVE so far: in 4.1.7 administrator/components/com_jdownloads/helpers/scan-interface.php opens without a login and prints the scan secret key, which is all the URL-based scan (scan.php) checks before creating, unpublishing or deleting download records (4.0.52 has no scan-interface.php). 4.1.8 for Joomla 5 and 6 is the only fixed release; no 4.0.x or 3.9.x fix has been published, so sites on older lines must move to 4.1.8 (4.0.x via 4.0.52). After updating, rotate the scan secret key in the jDownloads options and update any scheduled URL-based scan jobs, because the update does not rotate an existing key.
Affected versions: < 4.1.8
Full advisory: our disclosure post
jDownloads (com_jdownloads) 4.1.0 to 4.1.5 - Unauthenticated Arbitrary File Upload (malware hosting, RCE on misconfigured hosts)
jDownloads 4.1.0 to 4.1.5 ship a standalone, unauthenticated file-upload handler at administrator/components/com_jdownloads/assets/upload/upload-handler.php. The handler was introduced in the 4.1.0 release and is absent from 4.0.52 and earlier. The vendor confirms it was a test/experimental upload component unintentionally included in the release package. The endpoint has no _JEXEC guard, no Joomla session, no CSRF token and no permission check, and it bypasses jDownloads' own upload blacklist - it enforces only its own hardcoded extension allow-list (zip, rar, 7z, tar, gz, pdf, exe, msi, dat, mp3, mp4, images and Office documents). An unauthenticated attacker can POST arbitrary files of those types to a web-accessible directory and read them back over HTTP: malware/phishing hosting on the trusted domain and storage/disk abuse (default 500MB per file). It becomes remote code execution on any host that executes secondary file extensions (Apache AddHandler/mod_mime), or if an administrator has added an executable type (php/phtml) to the allowed list. Confirmed exploitable live (unauthenticated upload plus public read-back) on a default install. As of 2026-07-17 no fixed release is published (4.1.5 is current); the vendor's prepared fix removes the handler and the residual test_uploads directory on update. Mitigation until then: delete administrator/components/com_jdownloads/assets/upload/upload-handler.php and the administrator/components/com_jdownloads/test_uploads/ directory if present, or block web access to that path.
Affected versions: ≥ 4.1.0 and ≤ 4.1.5
Full advisory: www.jdownloads.com
jDownloads (com_jdownloads) 1.9.0 to 4.0.47 - Multiple CSRF and Information Disclosure
jDownloads versions 1.0.0 through 4.0.47 contain multiple cross-site request forgery vectors (CVE-2025-55758), allowing an attacker to make an authenticated administrator perform unintended actions by following a crafted link. jDownloads 3.9.8.2 additionally allows a remote user to alter address bar parameters and view the file names of other users' downloads (CVE-2022-27909). Update to 4.1.8 or later, which also fixes the separate 4.1.x flaws covered by their own rules (the unauthenticated upload fixed in 4.1.6 and the issues fixed in 4.1.8). This rule starts at 1.9.0 so it does not match the Xmap jDownloads integration plugin, which reports version 1.0.0 under the same element. Also within this rule: CVE-2020-19447, CVE-2020-19450, CVE-2020-19451 and CVE-2020-19455 (four SQL injections in jDownloads 3.2.63 via send.php f_marked_files_id, jdownloadshelper.php getUserLimits and updateLog, and categories.php filter_order). All four sit inside the 1.9.0 to 4.0.47 range and need no separate row.
Affected versions: ≥ 1.9.0 and ≤ 4.0.47
Full advisory: www.jdownloads.com
Each CVE page above links its official cve.org record and its NVD entry.
Running jDownloads on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.
CVE identifiers: CVE-2026-117551, CVE-2026-117543, CVE-2026-117544, CVE-2026-117550, CVE-2026-117542, CVE-2026-61900, CVE-2025-55758, CVE-2022-27909. Rules current as of 15 November 2026.
