Phoca Download (com_phocadownload) below 6.1.3 - Authenticated Arbitrary File Upload (RCE) (CVE-2026-57828, CVSS 9.0 Critical)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Fixed in 6.1.3 (10 Jul 2026), which drops allow_unsafe on both File::upload() calls and replaces the front-end allow-list gate ($frontEnd == 1) with (int)$frontEnd > 0. Update to 6.1.3 or later; if you cannot, switch off user uploads (enable_user_cp). This rule covers the 6.x branch only. Phoca never backported the fix to the 3.x, 4.x or 5.x branches, which are tracked as separate advisories.
Affected versions: ≥ 6.0.0 and < 6.1.3
Full advisory: our disclosure post
Phoca Download (com_phocadownload) 3.x and earlier - Authenticated Arbitrary File Upload (RCE), no fixed release for Joomla 3 (CVE-2026-57828, CVSS 9.0 Critical)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Phoca fixed this on the 6.x branch only, in 6.1.3 (10 Jul 2026). The Joomla 3 line stops at 3.2.3 (8 Mar 2021) and still holds the vulnerable code: both File::upload() calls pass allow_unsafe=true and the front-end gate is still the pre-fix $frontEnd == 1 test. Verified on 27 Aug 2026 by diffing the released com_phocadownload zips. Joomla's update stream offers a Joomla 3 site only the 3.x line, so no update shown in Joomla Admin will ever clear this. Switch off user uploads (enable_user_cp), or move the site to a Joomla version that can run the patched 6.x build.
Affected versions: < 4.0.0
Full advisory: our disclosure post
Phoca Download (com_phocadownload) 4.x - Authenticated Arbitrary File Upload (RCE), no fixed 4.x release (CVE-2026-57828, CVSS 9.0 Critical)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Phoca fixed this on the 6.x branch only, in 6.1.3 (10 Jul 2026). The Joomla 4 line stops at 4.0.9 (28 Oct 2023) and still holds the vulnerable code: both File::upload() calls pass allow_unsafe=true and the front-end gate is still the pre-fix $frontEnd == 1 test. Verified on 27 Aug 2026 by diffing the released com_phocadownload zips. Joomla's update stream offers a Joomla 4 site only the 4.x line, so no update shown in Joomla Admin will ever clear this. Switch off user uploads (enable_user_cp), or move the site to a Joomla version that can run the patched 6.x build.
Affected versions: ≥ 4.0.0 and < 5.0.0
Full advisory: our disclosure post
Phoca Download (com_phocadownload) 5.x - Authenticated Arbitrary File Upload (RCE), no fixed 5.x release (CVE-2026-57828, CVSS 9.0 Critical)
When Phoca Download's non-default user-upload feature is enabled, the front-end User Control Panel upload path ignores the admin's configured file-type allow-list (File::upload with allow_unsafe=true), so any registered member can upload a .php web shell into the web-served /phocadownload/userupload/ directory and execute it: authenticated remote code execution. CVE-2026-57828 (Joomla CNA, CVSS 4.0 9.0 Critical). Phoca fixed this on the 6.x branch only, in 6.1.3 (10 Jul 2026). The Joomla 5 line stops at 5.1.3 (22 Aug 2025) and still holds the vulnerable code: both File::upload() calls pass allow_unsafe=true and the front-end gate is still the pre-fix $frontEnd == 1 test. Verified on 27 Aug 2026 by diffing the released com_phocadownload zips. 5.1.3 is the newest build Joomla will offer a Joomla 5 site, so no update shown in Joomla Admin will ever clear this, and being fully up to date on the 5.x line does not make the site safe. Switch off user uploads (enable_user_cp), or move the site to a Joomla version that can run the patched 6.x build.
Affected versions: ≥ 5.0.0 and < 6.0.0
Full advisory: our disclosure post
High
Phoca Download (com_phocadownload) 6.1.3 - Authenticated Path Traversal in the Upload Folder and Image Polyglot Upload Bypass
Phoca Download 6.1.3 does not validate the folder request parameter used by the file upload, so an upload can be steered outside the configured download folder by path traversal. Its image validation also relied on getimagesize alone, which a polyglot file (a valid image header followed by PHP code) passes. 6.1.4 rejects any folder value containing .., checks that the resolved path stays under the configured upload base, decodes and re-encodes uploaded images to strip polyglot payloads, removes shtml from the default MIME map, and writes index.html plus .htaccess and web.config into upload folders to block script execution (new harden_folder option, enabled by default). Uploading needs a Joomla account holding Phoca Download upload rights. Update to 6.1.5. Confirmed by diffing the released com_phocadownload zips on 2026-08-18. Versions below 6.1.3 are already flagged for CVE-2026-57828.
Affected versions: ≥ 6.1.3 and < 6.1.4
Full advisory: github.com
Phoca Download (com_phocadownload) 6.1.4 - Reflected XSS in the front-end user file list search
The front end user file list view echoes the search request value into the value attribute of the search input with no escaping, in site/views/user/tmpl/default_files.php. A crafted link breaks out of the attribute and runs attacker script in the browser of the logged in user who opens it. 6.1.5 wraps the value in htmlspecialchars with ENT_QUOTES. Update to 6.1.5. Confirmed by diffing the released com_phocadownload zips on 2026-08-18.
Affected versions: ≥ 6.1.4 and < 6.1.5
Full advisory: github.com
Running Phoca Download on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-57828, CVE-2026-76569. Rules current as of 13 September 2026.