Live › vulnerability › CVE-2026-105600
The StageIt extension for Joomla from php-web-design.com allows remote code execution through crafted setting strings. An attacker who can reach the site may be able to run code on the server, with a CVSS score of 8.6 reported by NVD.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 14:23 UTC. All times on this page are UTC.
Joomla sites with the StageIt staging extension installed, versions below 5.8.0 (Joomla 5) or below 6.4.0 (Joomla 6). Saving StageIt Options could write a value with an apostrophe into params.php and run it as PHP; because StageIt actions had no Joomla security token, a crafted page opened by a logged-in StageIt administrator could trigger this, so the attacker needs no account but needs an admin to visit a page. Sites that never installed StageIt, or removed it, can skip this.
| Product | Ecosystem | Affected | Fixed in |
|---|---|---|---|
| StageIt | joomla | >= 1.0, < 5.8.0 (Joomla 5 line); >= 6.0, < 6.4.0 | 5.8.0, 6.4.0 |
5.8.0 and 6.x below 6.4.0Update StageIt for Joomla 5 to 5.8.0, StageIt for Joomla 6 to 6.4.0 (released 24 Oct 2026, per the vendor changelog as relayed by mySites.guru)
Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5
This page as .md · .json · in your agent: get_signal("CVE-2026-105600")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.