{"id":"CVE-2026-105600","kind":"vulnerability","aliases":["CVE-2026-105600"],"related":[],"title":"Joomla StageIt extension: setting strings let attackers run remote code","description":"Joomla Extension - php-web-design.com - RCE via setting strings in StageIt 1.0-5.7.5, 6.0-6.3.5","summary":"The StageIt extension for Joomla from php-web-design.com allows remote code execution through crafted setting strings. An attacker who can reach the site may be able to run code on the server, with a CVSS score of 8.6 reported by NVD.","severity":"high","cvss":8.6,"epss":null,"exploited":false,"exploited_at":null,"products":[{"name":"StageIt","fixed":["5.8.0","6.4.0"],"affected":">= 1.0, < 5.8.0 (Joomla 5 line); >= 6.0, < 6.4.0","ecosystem":"joomla"}],"ecosystems":[],"tags":["csrf","joomla","other","php","rce","stageit","web-hosting"],"not_affected_if":["extension-not-installed","patched-5.8.0","patched-6.4.0"],"how_to_check":"In Joomla admin go to System > Manage > Extensions and find StageIt (php-web-design.com). Vulnerable: 5.x below 5.8.0 and 6.x below 6.4.0. NVD lists 1.0-5.7.5 and 6.0-6.3.5; StageIt 4 and older have no fix and were not checked by mySites.guru, so move off them or remove the extension. After updating, review /stgbackups/ and the StageIt log for pushes, restores or deletes nobody on your team ran.","fix":"Update StageIt for Joomla 5 to 5.8.0, StageIt for Joomla 6 to 6.4.0 (released 24 Oct 2026, per the vendor changelog as relayed by mySites.guru)","status":"open","published_at":"2026-11-02T14:17:34+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","triaged_at":"2026-11-02T14:24:47+00:00","updated_at":"2026-11-02T14:25:27+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-02T14:24:47Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"unknown","title":"Joomla StageIt extension: setting strings let attackers run remote code","impact":"high","summary":"The StageIt extension for Joomla from php-web-design.com allows remote code execution through crafted setting strings. An attacker who can reach the site may be able to run code on the server, with a CVSS score of 8.6 reported by NVD.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","php","web-hosting"],"confidence":0.5,"fix_status":"unknown","needs_auth":"unknown","worst_case":"Code runs on the web server, exposing site data and secrets","analyst_note":"Confirm the fixed StageIt version and whether authentication is needed, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105600 and the vendor's page.","how_to_check":"- Check whether the Joomla site has the StageIt extension installed in the Joomla extensions manager.\n- Check the installed StageIt version against the affected ranges `1.0-5.7.5` and `6.0-6.3.5`.","plain_action":"","needs_analyst":true,"not_affected_if":["extension-not-installed"],"who_is_affected":"Sites running the StageIt extension for Joomla in the affected version ranges are exposed. Sites without StageIt installed, or running a version outside those ranges, are not affected. The sources do not say what configuration or privileges are needed to reach the vulnerable setting handling.","user_interaction":"unknown","needs_special_setup":"unknown","severity_if_unknown":"unknown"},"cost_usd":0.000689,"input_tokens":4087,"output_tokens":560,"severity_before":"high"},"analyst_status":"done","analyst_note":"Confirm the fixed StageIt version and whether authentication is needed, using the NVD entry at https://nvd.nist.gov/vuln/detail/CVE-2026-105600 and the vendor's page.","search":"'-105600':13A,16A '-2026':12A,15A '1.0':76C '5.7.5':77C '6.0':78C '6.3.5':79C '8.6':63B 'abl':51B 'allow':34B 'attack':7A,43B 'code':10A,36B,54B 'craft':39B 'csrf':18B 'cve':11A,14A 'cvss':60B 'execut':37B 'extens':3A,29B,68C 'host':26B 'joomla':1A,19B,31B,67C 'let':6A 'may':49B 'nvd':66B 'php':21B 'php-web-design.com':33B,69C 'rce':22B,70C 'reach':46B 'remot':9A,35B 'report':64B 'run':8A,53B 'score':61B 'server':57B 'set':4A,40B,72C 'site':48B 'stageit':2A,17A,23B,28B,75C 'string':5A,41B,73C 'via':71C 'web':25B 'web-host':24B","nicknames":[],"mitigations":[],"who_affected":"Joomla sites with the StageIt staging extension installed, versions below 5.8.0 (Joomla 5) or below 6.4.0 (Joomla 6). Saving StageIt Options could write a value with an apostrophe into params.php and run it as PHP; because StageIt actions had no Joomla security token, a crafted page opened by a logged-in StageIt administrator could trigger this, so the attacker needs no account but needs an admin to visit a page. Sites that never installed StageIt, or removed it, can skip this.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["stageit"],"ptokens":["stageit"],"labels":["csrf","high","joomla","other","php","rce","stageit","webhosting"],"first_public_at":"2026-11-02T14:17:34+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:H/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-105600","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-105600","severity":null,"published_at":"2026-11-02T14:17:34+00:00","modified_at":"2026-11-02T14:17:34+00:00","first_seen_at":"2026-11-02T14:23:23+00:00","fetched_at":"2026-11-02T14:23:23+00:00","note":null},{"source":"analyst","external_id":"CVE-2026-105600:1374","url":null,"severity":null,"published_at":"2026-11-02T14:25:27+00:00","modified_at":"2026-11-02T14:25:27+00:00","first_seen_at":"2026-11-02T14:25:27+00:00","fetched_at":"2026-11-02T14:25:27+00:00","note":"Fix versions 5.8.0/6.4.0 and CSRF+params.php chain come from mySites.guru's reading of the vendor changelog; the vendor page I could fetch only showed the older changelog (up to 5.6.4), and NVD page returned no text. So nothing marked verified. No exploitation or PoC reported; mySites.guru did not test. CVSS 8.6 is NVD's/mySites' reading. Not 'unauthenticated' strictly: needs admin interaction."}],"documents":[{"id":52291,"url":"https://mysites.guru/blog/stageit-5-8-0-6-4-0-security-release/","title":"StageIt 5.8.0 and 6.4.0 fix CSRF on every action (mySites.guru)","kind":"blog","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"describes","confidence":null,"note":null},{"id":52292,"url":"https://php-web-design.com/Information/stageit-5-changelog.html","title":"StageIt 5 ChangeLog (vendor)","kind":"vendor","source":"analyst","publisher":null,"text":null,"published_at":null,"relation":"mentions","confidence":null,"note":null}],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}