{"id":"CVE-2026-102785","kind":"vulnerability","aliases":["CVE-2026-102785"],"related":[],"title":"YOOtheme Pro: unauthenticated image handler lets attackers upload and run PHP","description":"Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.","summary":"YOOtheme Pro's public image transformation handler does not fully verify its request signature, so an attacker can reuse a signature from a public image URL and add operations. This lets them write a PHP-executable file into a public media directory and run code on the server without logging in.","severity":"critical","cvss":10.0,"epss":0.00701,"exploited":false,"exploited_at":null,"products":[{"name":"YOOtheme Pro","fixed":["5.0.53"],"affected":">= 5.0.0, <= 5.0.52","ecosystem":"joomla"}],"ecosystems":["joomla"],"tags":["joomla","package","php","poc-public","self-hosted","yootheme-pro"],"not_affected_if":["patched-5.0.53","version-outside-5.0.0-5.0.52","yootheme-pro-4"],"how_to_check":"Joomla admin > System > Manage > Extensions: check YOOtheme Pro version; 5.0.0 to 5.0.52 is vulnerable, 5.0.53+ fixed, 4.x not affected. Look for .php files or PNG/PHP polyglots in public media/image cache directories (e.g. under images/ and the YOOtheme cache) that you did not create.","fix":"Update YOOtheme Pro to 5.0.53 or later (Joomla Extensions manager / YOOtheme updater). Back up first. Then check for unexpected PHP files in public media and image cache dirs.","status":"open","published_at":"2026-10-22T13:17:27+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","triaged_at":"2026-10-23T22:32:25+00:00","updated_at":"2026-10-24T07:15:51+00:00","category":"package","confidence":0.85,"triage":{"at":"2026-10-23T22:32:25Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"YOOtheme Pro: unauthenticated image handler lets attackers upload and run PHP","impact":"high","summary":"YOOtheme Pro's public image transformation handler does not fully verify its request signature, so an attacker can reuse a signature from a public image URL and add operations. This lets them write a PHP-executable file into a public media directory and run code on the server without logging in.","category":"package","who_cares":["joomla","yootheme-pro","php","self-hosted"],"confidence":0.8,"needs_auth":"no","worst_case":"Attacker runs PHP code on the server without any account.","analyst_note":"Find the patched YOOtheme Pro version and vendor advisory; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-102785 does not name a fixed release.","how_to_check":"Check the installed YOOtheme Pro version in the Joomla extensions manager; versions 5.0.0 through 5.0.52 are affected.\nLook for unexpected PHP files in public media or image cache directories.","needs_analyst":true,"not_affected_if":["version-outside-5.0.0-5.0.52"],"user_interaction":"no","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000881,"input_tokens":3034,"output_tokens":1155,"severity_before":"critical"},"analyst_status":"done","analyst_note":"Find the patched YOOtheme Pro version and vendor advisory; the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-102785 does not name a fixed release.","search":"'-102785':14A,17A '-2026':13A,16A '5.0.0':93C '5.0.52':94C 'access':99C 'add':59B 'addit':132C 'attack':7A,48B,119C,146C 'attacker-control':145C 'bind':104C 'cach':140C 'code':77B,88C 'control':147C 'cve':12A,15A 'destin':111C 'directori':74B,141C,155C 'disclos':124C 'execut':68B,89C,152C 'extens':84C 'file':69B 'fulli':41B 'handler':5A,38B,102C 'host':28B 'imag':4A,36B,56B,100C,106C,129C,133C 'incomplet':103C 'inject':131C 'intend':139C 'joomla':20B,83C 'legitim':127C 'let':6A,62B 'log':82B 'media':73B,154C 'normal':105C 'oper':60B,107C,134C 'output':110C 'packag':21B 'php':11A,22B,67B 'php-execut':66B 'png/php':148C 'poc':24B 'poc-publ':23B 'polyglot':149C 'pro':2A,19A,31B,33B,92C,96C 'public':25B,35B,55B,72B,98C,128C,153C 'remot':87C,118C 'request':44B,114C 'reus':50B,121C 'run':10A,76B 'self':27B 'self-host':26B 'server':80B 'signatur':45B,52B,115C,123C 'transform':37B,101C 'travers':135C 'unauthent':3A,86C,117C 'upload':8A 'url':57B,130C 'verifi':42B 'without':81B 'write':64B,143C 'yoothem':1A,30B,32B,91C,95C 'yootheme':18A 'yootheme-pro':29B 'yootheme.com':85C","nicknames":[],"mitigations":[],"who_affected":null,"tier":"B","verified":{},"analyst_revisit_at":null,"first_public_at":"2026-10-21T00:00:00+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":1,"sources":[{"source":"nvd","external_id":"CVE-2026-102785","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102785","severity":null,"published_at":"2026-10-22T13:17:27+00:00","modified_at":"2026-10-22T17:36:46+00:00","first_seen_at":"2026-10-23T21:57:31+00:00","fetched_at":"2026-10-23T22:29:02+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-102785:303","url":null,"severity":null,"published_at":"2026-10-23T22:48:37+00:00","modified_at":"2026-10-23T22:48:37+00:00","first_seen_at":"2026-10-23T22:48:37+00:00","fetched_at":"2026-10-23T22:48:37+00:00","note":"Fixed in YOOtheme Pro 5.0.53 (21 Oct 2026) per vendor changelog; affected 5.0.0-5.0.52 per CVE record; Pro 4 and earlier not affected. No exploitation or public PoC found; no interim mitigation known (mySites.guru)."},{"source":"github-poc","external_id":"antid00t/CVE-2026-102785","url":"https://github.com/antid00t/CVE-2026-102785","severity":null,"published_at":"2026-10-24T00:19:23+00:00","modified_at":null,"first_seen_at":"2026-10-24T00:39:46+00:00","fetched_at":"2026-10-24T00:39:46+00:00","note":null},{"source":"epss","external_id":"CVE-2026-102785","url":"https://api.first.org/data/v1/epss?cve=CVE-2026-102785","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-24T07:15:51+00:00","fetched_at":"2026-10-25T12:38:51+00:00","note":null}],"documents":[{"id":1611,"url":"https://yootheme.com/changelog","title":"YOOtheme Pro Changelog (5.0.53)","kind":"vendor","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1612,"url":"https://mysites.guru/blog/yootheme-pro-5-critical-security-update/","title":"YOOtheme Pro 5.0.53 critical RCE fix (mySites.guru)","kind":"blog","source":"analyst","text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":1613,"url":"https://www.cve.org/CVERecord?id=CVE-2026-102785","title":"CVE Record CVE-2026-102785","kind":"advisory","source":"analyst","text":null,"published_at":null,"relation":"advisory","confidence":null,"note":null},{"id":1614,"url":"https://x.com/yootheme/status/2112897636470534544","title":null,"kind":"post","source":"analyst","text":"@yootheme (YOOtheme, 13915 followers) · likes 6 reposts 2\nCritical security update for YOOtheme Pro 5. We fixed unauthenticated remote code execution via image handler (CVE-2026-102785). All users running YOOtheme Pro 5 must update immediately to 5.0.53. YOOtheme Pro 4 and earlier versions are not affected.","published_at":"2026-10-21T00:00:00+00:00","relation":"discussion","confidence":null,"note":null},{"id":2645,"url":"https://github.com/antid00t/CVE-2026-102785","title":"antid00t/CVE-2026-102785","kind":"poc","source":"github","text":"CVE-2026-102785 YOOtheme Pro 5.0.0-5.0.52 │ Unauthenticated RCE Mass Exploit & WAF Bypass\n\nstars 0","published_at":"2026-10-24T00:19:23+00:00","relation":"poc","confidence":null,"note":"0 stars"}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}