Newest first. CVSS is the score published in each CVE record, where it has one; the severity column is the rating our check uses.
Phoca Download (com_phocadownload) below 6.1.3 - Authenticated Arbitrary File Upload (RCE) (CVE-2026-57828, CVSS 9.0 Critical)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Fixed in 6.1.3 (10 Jul 2026), which drops allow_unsafe on both File::upload() calls and replaces the front-end allow-list gate ($frontEnd == 1) with (int)$frontEnd > 0. Update to 6.1.3 or later; if you cannot, switch off user uploads (enable_user_cp). This rule covers the 6.x branch only. Phoca never backported the fix to the 3.x, 4.x or 5.x branches, which are tracked as separate advisories.
Affected versions: ≥ 6.0.0 and < 6.1.3
Full advisory: our disclosure post
Phoca Download (com_phocadownload) 3.x and earlier - Authenticated Arbitrary File Upload (RCE), no fixed release for Joomla 3 (CVE-2026-57828, CVSS 9.0 Critical)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Phoca fixed this on the 6.x branch only, in 6.1.3 (10 Jul 2026). The Joomla 3 line stops at 3.2.3 (8 Mar 2021) and still holds the vulnerable code: both File::upload() calls pass allow_unsafe=true and the front-end gate is still the pre-fix $frontEnd == 1 test. Verified on 27 Aug 2026 by diffing the released com_phocadownload zips. Joomla's update stream offers a Joomla 3 site only the 3.x line, so no update shown in Joomla Admin will ever clear this. Switch off user uploads (enable_user_cp), or move the site to a Joomla version that can run the patched 6.x build.
Affected versions: < 4.0.0
Full advisory: our disclosure post
Phoca Download (com_phocadownload) 4.x - Authenticated Arbitrary File Upload (RCE), no fixed 4.x release (CVE-2026-57828, CVSS 9.0 Critical)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Phoca fixed this on the 6.x branch only, in 6.1.3 (10 Jul 2026). The Joomla 4 line stops at 4.0.9 (28 Oct 2023) and still holds the vulnerable code: both File::upload() calls pass allow_unsafe=true and the front-end gate is still the pre-fix $frontEnd == 1 test. Verified on 27 Aug 2026 by diffing the released com_phocadownload zips. Joomla's update stream offers a Joomla 4 site only the 4.x line, so no update shown in Joomla Admin will ever clear this. Switch off user uploads (enable_user_cp), or move the site to a Joomla version that can run the patched 6.x build.
Affected versions: ≥ 4.0.0 and < 5.0.0
Full advisory: our disclosure post
Phoca Download (com_phocadownload) 5.x - Authenticated Arbitrary File Upload (RCE), no fixed 5.x release (CVE-2026-57828, CVSS 9.0 Critical)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Phoca fixed this on the 6.x branch only, in 6.1.3 (10 Jul 2026). The Joomla 5 line stops at 5.1.3 (22 Aug 2025) and still holds the vulnerable code: both File::upload() calls pass allow_unsafe=true and the front-end gate is still the pre-fix $frontEnd == 1 test. Verified on 27 Aug 2026 by diffing the released com_phocadownload zips. 5.1.3 is the newest build Joomla will offer a Joomla 5 site, so no update shown in Joomla Admin will ever clear this, and being fully up to date on the 5.x line does not make the site safe. Switch off user uploads (enable_user_cp), or move the site to a Joomla version that can run the patched 6.x build.
Affected versions: ≥ 5.0.0 and < 6.0.0
Full advisory: our disclosure post
High
Phoca Download (com_phocadownload) 6.1.3 - Authenticated Path Traversal in the Upload Folder and Image Polyglot Upload Bypass
Phoca Download 6.1.3 does not validate the folder request parameter used by the file upload, so an upload can be steered outside the configured download folder by path traversal. Its image validation also relied on getimagesize alone, which a polyglot file (a valid image header followed by PHP code) passes. 6.1.4 rejects any folder value containing .., checks that the resolved path stays under the configured upload base, decodes and re-encodes uploaded images to strip polyglot payloads, removes shtml from the default MIME map, and writes index.html plus .htaccess and web.config into upload folders to block script execution (new harden_folder option, enabled by default). Uploading needs a Joomla account holding Phoca Download upload rights. Update to 6.1.5. Confirmed by diffing the released com_phocadownload zips on 2026-08-18. Versions below 6.1.3 are already flagged for CVE-2026-57828.
Affected versions: ≥ 6.1.3 and < 6.1.4
Full advisory: github.com
Phoca Download (com_phocadownload) below 6.1.6 - Cross-Site Request Forgery in front-end file publish, unpublish and delete
Phoca Download before 6.1.6 did not check Joomla's security token on the front-end User Control Panel file actions (publish, unpublish and delete). If a logged-in user who has the delete right on a download category opens a crafted link or page, the attacker can make the site unpublish or delete files in that category under that user's account, including removing the file from disk when "Delete existing files" is enabled. Exposure needs the category delete right granted to front-end users, which is off by default. Published as CVE-2026-102787 (Joomla CNA, 27 October 2026, CVSS 4.0 5.3 Medium), titled CSRF in category management, affecting 3.1.0 to 6.1.5. Only the Joomla 6 line is fixed: Phoca's update feed offers Joomla 3 sites 3.2.3, Joomla 4 sites 4.0.9 and Joomla 5 sites 5.1.3, and all three still lack the token check, so those sites cannot get the fix from the update screen. Update to 6.1.6 (on Joomla 5 install com_phocadownload_v6.1.6.zip by hand). Interim mitigation: remove front-end users from the category delete rights.
Affected versions: < 6.1.6
Full advisory: our disclosure post
Phoca Download (com_phocadownload) 6.1.4 - Reflected XSS in the front-end user file list search
The front end user file list view echoes the search request value into the value attribute of the search input with no escaping, in site/views/user/tmpl/default_files.php. A crafted link breaks out of the attribute and runs attacker script in the browser of the logged in user who opens it. 6.1.5 wraps the value in htmlspecialchars with ENT_QUOTES. Update to 6.1.5. Confirmed by diffing the released com_phocadownload zips on 2026-08-18.
Affected versions: ≥ 6.1.4 and < 6.1.5
Full advisory: github.com
Each CVE page above links its official cve.org record and its NVD entry.