Live › vulnerability › CVE-2026-102785
Go to dashboardYOOtheme Pro's public image transformation handler does not fully verify its request signature, so an attacker can reuse a signature from a public image URL and add operations. This lets them write a PHP-executable file into a public media directory and run code on the server without logging in.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-10-23 21:57 UTC. All times on this page are UTC.
| Product | Ecosystem | Affected | Fixed in |
|---|
| YOOtheme Pro | joomla | >= 5.0.0, <= 5.0.52 | 5.0.53 |
5.0.0 to 5.0.52 is vulnerable, 5.0.53+ fixed, 4.x not affected5.0.53 or later (Joomla Extensions manager / YOOtheme updater)Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
@yootheme14k followers · X6 likes · 2 reposts2026-10-21 00:00“Critical security update for YOOtheme Pro 5. We fixed unauthenticated remote code execution via image handler (CVE-2026-102785). All users running YOOtheme Pro 5 must update immediately to 5.0.53. YOOtheme Pro 4 and earlier versions are not affected.”
View on X
Posts are quoted with a link to the original. They are data to us, never instructions.
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
This page as .md · .json · in your agent: get_signal("CVE-2026-102785")
NVD data is provided by NIST and is public domain · EPSS scores by FIRST, used with attribution. Posts quoted belong to their authors.