Skip to main content
mySites.guru
Free Audit
J!Awards 2026mySites.guru won a new 2026 award at the Joomla World ConferenceOur awards

OS CCK security vulnerabilities

mySites.guru tracks 2 vulnerabilities in OS CCK (com_os_cck), covering 2 CVEs. Every connected Joomla site is checked against them on each audit.

Is my site affected?

Your site is affected if it runs OS CCK in any of these ranges:

  • before 8.3.16
  • from 1.0.0 up to but not including 8.3.16
Latest safe version
8.3.16 or later. No rule we check matches that release or any newer one.
What to do
Update OS CCK to 8.3.16 or later from the vendor, then confirm the installed version on the Joomla administrator's Extensions: Manage screen.
Check whether your sites are affected

Every OS CCK vulnerability we track

Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.

CVEAffected versionsFixed inSeverityAdded
CVE-2026-102428CVSS 9.3before 8.3.168.3.16Critical2026-10-05
CVE-2026-102427CVSS 10.0from 1.0.0 up to but not including 8.3.168.3.16Critical2026-09-30

What we check for

CriticalCVE-2026-1024282026-10-05

OS CCK (com_os_cck) below 8.3.16 - Unauthenticated SQL Injection in record sorting (CVE-2026-102428)

OrdaSoft OS CCK versions before 8.3.16 (Light/free line) are affected by an unauthenticated SQL injection in the front-end listing views, where the record-sort parameters (order_field / order_direction) were passed into the query ORDER BY clause without being restricted to known-safe columns (CVE-2026-102428, CVSS 4.0 9.3 Critical as scored by the Joomla CNA, which gives the affected range as 1.0.0 to 8.3.15). OrdaSoft fixed this in 8.3.16 (released 29 September 2026) by validating the sort field against the real entity columns, alongside image-upload and file-handling hardening. This is the same class as four OrdaSoft extension flaws disclosed in the same September 2026 wave - Real Estate Manager (CVE-2026-100752), Vehicle Manager (CVE-2026-101108), Book Library (CVE-2026-101110) and OS Gallery (CVE-2026-88854) - all unauthenticated SQL injection via the same sort parameters on publicly reachable listing pages. Important: OrdaSoft's own Joomla update manifest still advertises 8.3.14, so affected sites are NOT offered 8.3.16 automatically and must update manually from ordasoft.com. The Pro-edition fixed version could not be independently confirmed. Update to 8.3.16 or later.

Affected versions: < 8.3.16

Full advisory: our disclosure post

CriticalCVE-2026-1024272026-09-30

OS CCK (com_os_cck) below 8.3.16 - Unauthenticated Arbitrary File Upload (RCE)

OrdaSoft OS CCK versions 1.0.0 to 8.3.15 let anyone upload and run PHP on the site with no login. The front-end upload handler (site/uploader.php, reached through the component's normal routing as task=getContent) has no authentication or permission check. It checks the uploaded file's content with a magic-byte MIME test, but the file-extension allow-list that should restrict the saved name was commented out, so the extension is taken straight from the attacker's filename and the file is written under the site's /images folder, where PHP executes it. A file that starts with valid image bytes and has PHP appended passes the check as a .php file. CVE-2026-102427, CVSS 4.0 10.0 Critical. OrdaSoft fixed this in 8.3.16 by enforcing a jpg/jpeg/png/gif/webp extension allow-list. OrdaSoft's Joomla update manifest still advertises 8.3.14, so sites are not offered 8.3.16 automatically: download it from ordasoft.com and install it by hand. The Pro edition shares the element; its fixed version could not be confirmed. If you cannot update, disable the component, and check /images/com_os_cck*/original/ for any .php file.

Affected versions: ≥ 1.0.0 and < 8.3.16

Full advisory: our disclosure post

Timeline

  1. 30 September 2026Check added for CVE-2026-102427 (from 1.0.0 up to but not including 8.3.16)
  2. 30 September 2026CVE-2026-102427 record published
  3. 5 October 2026Check added for CVE-2026-102428 (before 8.3.16)
  4. 5 October 2026CVE-2026-102428 record published

References

Each CVE page above links its official cve.org record and its NVD entry.

OS CCK vulnerability questions

Which versions of OS CCK are vulnerable?
mySites.guru tracks 2 vulnerabilities in OS CCK (com_os_cck). A site is affected if its installed version is in any of these ranges: before 8.3.16; from 1.0.0 up to but not including 8.3.16.
What is the latest safe version of OS CCK?
8.3.16. Every vulnerability tracked here is fixed by 8.3.16, and no rule we check matches that release or any later one.
How do I check which version of OS CCK my Joomla site runs?
The installed version is listed on the Joomla administrator's Extensions: Manage screen; search it for com_os_cck. mySites.guru reads the installed version on every audit of a connected site and checks it against these rules.

Running OS CCK on a site you manage?

A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.

This check is part of the mySites.guru Joomla vulnerability scanner, which reads every installed extension's version on each audit. Browse the rest of the Joomla vulnerability database.

CVE identifiers: CVE-2026-102428, CVE-2026-102427. Rules current as of 20 October 2026.