# jDownloads security vulnerabilities [Joomla Vulnerability Database](https://mysites.guru/vulnerabilities/)/jDownloads # jDownloads security vulnerabilities mySites.guru tracks 2 vulnerabilities in jDownloads (com\_jdownloads), covering 3 CVEs. Every connected Joomla site is checked against them on each audit. ## Is my site affected? Your site is affected if it runs jDownloads in any of these ranges: - from 4.1.0 up to and including 4.1.5 - from 1.9.0 up to and including 4.0.47 - **Latest safe version** - 4.1.6 or later. No rule we check matches that release or any newer one. - **What to do** - Update jDownloads to 4.1.6 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen. [Check whether your sites are affected](https://mysites.guru/free-audit/) ## Every jDownloads vulnerability we track Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses. CVE Affected versions Fixed in Severity Added [CVE-2026-61900](https://mysites.guru/vulnerabilities/CVE-2026-61900/)CVSS 10.0 from 4.1.0 up to and including 4.1.5 after 4.1.5 Critical 2026-07-17 [CVE-2025-55758](https://mysites.guru/vulnerabilities/CVE-2025-55758/)CVSS 5.4[CVE-2022-27909](https://mysites.guru/vulnerabilities/CVE-2022-27909/) from 1.9.0 up to and including 4.0.47 update to 4.1.6 Medium 2025-10-28 ## What we check for Critical[CVE-2026-61900](https://mysites.guru/vulnerabilities/CVE-2026-61900/)2026-07-17 ### jDownloads (com\_jdownloads) 4.1.0 to 4.1.5 - Unauthenticated Arbitrary File Upload (malware hosting, RCE on misconfigured hosts) jDownloads 4.1.0 to 4.1.5 ship a standalone, unauthenticated file-upload handler at administrator/components/com\_jdownloads/assets/upload/upload-handler.php. The handler was introduced in the 4.1.0 release and is absent from 4.0.52 and earlier. The vendor confirms it was a test/experimental upload component unintentionally included in the release package. The endpoint has no \_JEXEC guard, no Joomla session, no CSRF token and no permission check, and it bypasses jDownloads' own upload blacklist - it enforces only its own hardcoded extension allow-list (zip, rar, 7z, tar, gz, pdf, exe, msi, dat, mp3, mp4, images and Office documents). An unauthenticated attacker can POST arbitrary files of those types to a web-accessible directory and read them back over HTTP: malware/phishing hosting on the trusted domain and storage/disk abuse (default 500MB per file). It becomes remote code execution on any host that executes secondary file extensions (Apache AddHandler/mod\_mime), or if an administrator has added an executable type (php/phtml) to the allowed list. Confirmed exploitable live (unauthenticated upload plus public read-back) on a default install. As of 2026-07-17 no fixed release is published (4.1.5 is current); the vendor's prepared fix removes the handler and the residual test\_uploads directory on update. Mitigation until then: delete administrator/components/com\_jdownloads/assets/upload/upload-handler.php and the administrator/components/com\_jdownloads/test\_uploads/ directory if present, or block web access to that path. Affected versions: ≥ 4.1.0 and ≤ 4.1.5 Full advisory: [www.jdownloads.com](https://www.jdownloads.com/index.php/downloads/summary/6-jdownloads/70-jdownloads-4.html) Medium[CVE-2025-55758](https://mysites.guru/vulnerabilities/CVE-2025-55758/)[CVE-2022-27909](https://mysites.guru/vulnerabilities/CVE-2022-27909/)2025-10-28 ### jDownloads (com\_jdownloads) 1.9.0 to 4.0.47 - Multiple CSRF and Information Disclosure jDownloads versions 1.0.0 through 4.0.47 contain multiple cross-site request forgery vectors (CVE-2025-55758), allowing an attacker to make an authenticated administrator perform unintended actions by following a crafted link. jDownloads 3.9.8.2 additionally allows a remote user to alter address bar parameters and view the file names of other users' downloads (CVE-2022-27909). Update to 4.1.6 or later, which is also the release that fixes the separate unauthenticated upload flaw covered by its own rule. This rule starts at 1.9.0 so it does not match the Xmap jDownloads integration plugin, which reports version 1.0.0 under the same element. Also within this rule: CVE-2020-19447, CVE-2020-19450, CVE-2020-19451 and CVE-2020-19455 (four SQL injections in jDownloads 3.2.63 via send.php f\_marked\_files\_id, jdownloadshelper.php getUserLimits and updateLog, and categories.php filter\_order). All four sit inside the 1.9.0 to 4.0.47 range and need no separate row. Affected versions: ≥ 1.9.0 and ≤ 4.0.47 Full advisory: [www.jdownloads.com](https://www.jdownloads.com/) ## Timeline 1. 6 May 2022[CVE-2022-27909 record published](https://mysites.guru/vulnerabilities/CVE-2022-27909/) 2. 28 October 2025Check added for CVE-2025-55758 and CVE-2022-27909 (from 1.9.0 up to and including 4.0.47) 3. 28 October 2025[CVE-2025-55758 record published](https://mysites.guru/vulnerabilities/CVE-2025-55758/) 4. 17 July 2026Check added for CVE-2026-61900 (from 4.1.0 up to and including 4.1.5) 5. 17 July 2026[We published: jDownloads 4.1 Shipped an Unauthenticated Upload Endpoint, Now Fixed in 4.1.6](https://mysites.guru/blog/jdownloads-4-1-unauthenticated-upload-flaw/) 6. 20 July 2026[CVE-2026-61900 record published](https://mysites.guru/vulnerabilities/CVE-2026-61900/) ## What we have written about jDownloads [![jDownloads 4.1 Shipped an Unauthenticated Upload Endpoint, Now Fixed in 4.1.6](https://mysites.guru/_astro/jdownloads-4-1-unauthenticated-upload-flaw.D43bEBrE_DJjoP.webp) ### jDownloads 4.1 Shipped an Unauthenticated Upload Endpoint, Now Fixed in 4.1.6 jDownloads 4.1.0 to 4.1.5 shipped a leftover test script that let anyone upload files to your Joomla site with no login. Update to 4.1.6, which removes it. 17 Jul 2026 ](https://mysites.guru/blog/jdownloads-4-1-unauthenticated-upload-flaw/) ## References - [jdownloads.com/index.php/downloads/summary/6-jdownloads/70-jdownloads](https://www.jdownloads.com/index.php/downloads/summary/6-jdownloads/70-jdownloads-4.html) - [jdownloads.com](https://www.jdownloads.com/) Each CVE page above links its official cve.org record and its NVD entry. ## jDownloads vulnerability questions Show all Which versions of jDownloads are vulnerable? mySites.guru tracks 2 vulnerabilities in jDownloads (com\_jdownloads). A site is affected if its installed version is in any of these ranges: from 4.1.0 up to and including 4.1.5; from 1.9.0 up to and including 4.0.47. What is the latest safe version of jDownloads? 4.1.6. Every vulnerability tracked here is fixed by 4.1.6, and no rule we check matches that release or any later one. How do I check which version of jDownloads my Joomla site runs? The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com\_jdownloads. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules. ## Running jDownloads on a site you manage? A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, [fix.mysites.guru](https://fix.mysites.guru/) is a single fixed fee per incident, usually resolved the same day. This check is part of the [mySites.guru Joomla vulnerability scanner](https://mysites.guru/joomla-vulnerability-scanner/), which reads every installed extension's version on each audit. Browse the rest of the [Joomla vulnerability database](https://mysites.guru/vulnerabilities/). CVE identifiers: [CVE-2026-61900](https://mysites.guru/vulnerabilities/CVE-2026-61900/), [CVE-2025-55758](https://mysites.guru/vulnerabilities/CVE-2025-55758/), [CVE-2022-27909](https://mysites.guru/vulnerabilities/CVE-2022-27909/). Rules current as of 14 October 2026.