ZOO (com_zoo) below 4.1.64 - Unauthenticated Arbitrary File Upload (RCE, CVSS 10.0), Unauthenticated SQL Injection (CVSS 9.3) and Open Redirect
YOOtheme ZOO (com_zoo) up to and including 4.1.63 contains three unauthenticated vulnerabilities, all fixed in 4.1.64 released on 19 August 2026, and all published as CVEs by the Joomla CNA on 19 August 2026. All three were found and reported by Phil Taylor of mySites.guru, who is credited as finder on each record. Every one was proved live on a test install, not inferred from reading code. 1) Unauthenticated arbitrary file upload leading to remote code execution (CVE-2026-74803, CWE-434, CVSS 4.0 base 10.0 Critical, AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H). The Image element used in ZOO front-end submission forms validates uploads against the client-supplied Content-Type header only. It never inspects the file contents and sets no extension allow-list, and the filename passes through Joomla File::makeSafe, which preserves a .php extension. An anonymous visitor can therefore submit a PHP file declared as image/jpeg and have it written into images/zoo/uploads/ inside the web root, where the web server executes it. That is a full remote code execution with no login, no CSRF obstacle and no user interaction. Guest access to submissions is the ZOO default and captcha is off by default. A proof-of-concept shell uploaded this way executed on the test host. 2) Unauthenticated SQL injection (CVE-2026-74804, CWE-89, CVSS 4.0 base 9.3 Critical). ItemController::element() interpolates the filter_type request value straight into the query as a.type = "..." and the type_filter array as a.type IN ("..."), with no quoting and no escaping. An anonymous request to index.php?option=com_zoo&app_id=<id>&controller=item&task=element can break out of the string, bypass the published-state and view-access filters to read unpublished and access-restricted items, and use a UNION to read arbitrary data from the database. Exfiltration of the MySQL version and the database name was demonstrated as an unauthenticated guest. 3) Open redirect (CVE-2026-75114, CWE-601, CVSS 4.0 base 5.1 Medium). CommentController::twitterAuthenticate() passes the referer request parameter directly to setRedirect() with no scheme or host validation, so the site issues an HTTP 303 to any attacker-chosen destination. It works whether or not Twitter authentication is configured, and gives phishing campaigns a redirect through a trusted domain. Update to ZOO 4.1.66 or later now - 4.1.64 fixed these three findings, but 4.1.65 and 4.1.66 each fixed further ones, so 4.1.66 is the minimum safe version. Until you can: remove the Image element from any published front-end submission form, or restrict those forms so guests cannot reach them, and audit images/zoo/uploads/ for anything that is not an image. Because the upload flaw needs no login, any site that ran a vulnerable version while internet-facing should be treated as potentially compromised until checked - look for .php files anywhere under images/, for administrator accounts you do not recognise, and consider rotating the Joomla secret and stored credentials. Two further releases followed. 4.1.65 completed the tag-management authorisation fix, published as CVE-2026-76610 (CVSS 6.9). 4.1.66, on 21 August 2026, fixed three more published CVEs on the front-end submission path (CVE-2026-76611 arbitrary directory listing, CVE-2026-77028 reflected XSS and open redirect, CVE-2026-77029 missing CSRF protection) plus two unannounced hardening fixes on the same upload path that produced the RCE. All of these are also credited to Phil Taylor of mySites.guru. The minimum safe version is 4.1.66.
Affected versions: < 4.1.64
Full advisory: www.cve.org
ZOO (com_zoo) 4.1.65 - Unauthenticated Stored XSS (CVSS 8.6), Unauthenticated Arbitrary Directory Listing (6.9), Reflected XSS and Open Redirect (5.3), and Missing Front-End CSRF Protection
YOOtheme ZOO (com_zoo) 4.1.65 is affected by a further set of front-end vulnerabilities, all fixed in ZOO 4.1.66 released on 21 August 2026. All four were published as CVEs by the Joomla CNA on 21 August 2026, each crediting Phil Taylor of mySites.guru as finder, each with an affected range of 1.0.0 to 4.1.65. This rule covers 4.1.65 only, because anything below that is already flagged by the more severe rules for the CVSS 10.0 unauthenticated file upload (CVE-2026-74803, fixed in 4.1.64) and the tag-management authorisation flaw (CVE-2026-76610, fixed in 4.1.65). 1) Unauthenticated stored cross-site scripting via user-controlled fields (CVE-2026-76612, CVSS 4.0 base 8.6 High, AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:L/SC:N/SI:N/SA:N). Input supplied in comments and in user-supplied field elements is not escaped on output, so an anonymous visitor can store script that then runs in the browser of anyone who views the affected page, administrators included. This is the most severe of the four and the one to plan around. 2) Unauthenticated arbitrary directory listing via the Gallery element (CVE-2026-76611, CVSS 4.0 base 6.9 Medium, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N). The Gallery element used in front-end submission forms lets an anonymous visitor walk and list directories outside the intended media path. YOOtheme describe the same fix in their changelog as a path traversal in Gallery element frontend submission. 3) Reflected cross-site scripting and open redirect via the submission redirect parameter (CVE-2026-77028, CVSS 4.0 base 5.3 Medium, AV:N/AC:L/AT:N/PR:N/UI:P/VC:L/VI:L/VA:L/SC:N/SI:N/SA:N). The redirect target used after a front-end submission is neither validated nor escaped, so an attacker-supplied link both bounces the visitor to an arbitrary destination and reflects script into the page. The YOOtheme changelog describes this only as rejecting external redirects, which understates the cross-site scripting half. 4) Missing CSRF tokens on front-end state changes (CVE-2026-77029, CVSS 4.0 base 4.6 Medium, AV:N/AC:L/AT:N/PR:H/UI:A/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N). Front-end and administrator state-changing tasks, including submission deletion, accept requests carrying no CSRF token, so a logged-in user can be made to delete or alter content simply by visiting an attacker-controlled page. The same release also fixes, without listing them as security fixes, two items sitting on the same unauthenticated front-end submission upload path that produced the CVSS 10.0 RCE: the Download element was not enforcing its configured extension allow-list for uploaded files, and the upload MIME validation added in 4.1.64 did not work on Joomla versions earlier than 4.4. Sites running Joomla 3 or Joomla 4.0 to 4.3 should therefore treat 4.1.66 as the first release in which the upload hardening is genuinely in force. 4.1.66 further fixes JSON and CSV extension validation on administrator imports, adds TLS certificate and hostname verification to Twitter API requests, and moves Akismet API traffic to TLS. Update to ZOO 4.1.66 or later. Until you can, remove the Gallery and Download elements from any published front-end submission form, disable guest commenting, or restrict those forms so that guests cannot reach them.
Affected versions: ≥ 4.1.65 and < 4.1.66
Full advisory: www.cve.org
ZOO (com_zoo) 4.1.64 - Unauthenticated Tag Modification (CVE-2026-76610, CVSS 6.9)
ZOO 4.1.64 fixed the three critical unauthenticated flaws present in 4.1.63 and below (CVE-2026-74803 arbitrary file upload leading to remote code execution, CVE-2026-74804 SQL injection, CVE-2026-75114 open redirect), but its tag-management hardening was incomplete. That gap is now published as CVE-2026-76610 (CVSS 4.0 base 6.9 Medium, AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N), credited to Phil Taylor of mySites.guru, with an affected range of 1.0.0 to 4.1.64. The Joomla CNA records it as unauthenticated tag modification, stating that the comment controller endpoint lacked ACL checks and so allowed tags to be altered with no login at all. Reading the shipped 4.1.64 package shows the matching administrator-side gap as well: the admin tag controller gained CSRF tokens on its remove and update tasks and a canManageTags() helper was added to the framework, but nothing in the package ever calls that helper and the zoo.tags.manage permission is absent from access.xml, so tag rename and tag delete were gated only by the component-wide core.manage check. On either reading the impact is to content integrity. This is NOT the CVSS 10.0 remote code execution, which 4.1.64 genuinely does fix. YOOtheme shipped the tag fix in 4.1.65 on 19 August 2026, hours after 4.1.64. Do not stop there. ZOO 4.1.66, released on 21 August 2026, fixed three further published CVEs on the front-end submission path (CVE-2026-76611 unauthenticated arbitrary directory listing, CVE-2026-77028 reflected XSS and open redirect, CVE-2026-77029 missing CSRF protection) plus two unannounced hardening fixes on the upload path. Update to ZOO 4.1.66 or later. If you cannot update immediately, restrict backend access to com_zoo to trusted administrators and restrict guest access to any published front-end submission form.
Affected versions: ≥ 4.1.64 and < 4.1.65
Full advisory: www.cve.org
Running ZOO on a site you manage?
A free audit tells you which of your Joomla and WordPress sites run an affected version, which are out of date, and which have not been backed up. No card required. If a site is already compromised, fix.mysites.guru is a single fixed fee per incident, usually resolved the same day.
CVE identifiers: CVE-2026-74803, CVE-2026-74804, CVE-2026-75114, CVE-2026-76611, CVE-2026-76612, CVE-2026-77028, CVE-2026-77029, CVE-2026-76610. Rules current as of 13 September 2026.
