Live › vulnerability › CVE-2026-105603
The DJ-Classifieds extension for Joomla lets a logged-in user upload arbitrary files. The sources say this leads to full remote code execution on the site.
Summary written from the sources below. Check the originals before acting.
First seen by InfraStack 2026-11-02 19:24 UTC. All times on this page are UTC.
Joomla sites running DJ-Classifieds below 3.11.3 are exposed. The attack needs a user account on the site that can reach the upload function, so sites with open or self-registration are at higher risk. Sites without the extension or with the patched version can skip it.
No product ranges from the sources yet.
3.11.3 or later (per the affected range '< 3.11.3').Each row is the first time that source carried this signal. The analyst’s rows are its own findings.
Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in DJ-Classifieds < 3.11.3 - The Joomla extension DJ-Classifieds is vulnerable to an unprivileged file upload, leading to full RCE.
This page as .md · .json · in your agent: get_signal("CVE-2026-105603")
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.