---
id: "CVE-2026-105606"
kind: "vulnerability"
aliases: ["CVE-2026-105606"]
title: "Joomla Custom Tables extension: unauthenticated file upload to web-accessible directory"
severity: "critical"
cvss: 9.5
epss: null
exploited: false
status: "open"
category: "other"
products: []
ecosystems: []
tags: ["custom-tables", "joomla", "other", "php", "self-hosted"]
not_affected_if: ["extension-not-installed", "no-public-submission-form", "version-3.7.8-or-later"]
published_at: "2026-11-02T19:17:50+00:00"
first_seen_at: "2026-11-02T19:24:39+00:00"
updated_at: "2026-11-02T19:26:32+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-105606", "first_seen_at": "2026-11-02T19:24:39+00:00"}]
---

# Joomla Custom Tables extension: unauthenticated file upload to web-accessible directory

The Custom Tables extension for Joomla lets an anonymous visitor upload a file with an attacker-chosen extension to a publicly served temporary folder, and the response reveals where it was stored. An attacker can use this to host phishing or malware pages under the victim site's domain.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed Custom Tables extension version in the Joomla administrator under Extensions > Manage (unknown if the sources do not say where it is listed)
- Check whether the site has a public Custom Tables submission form (unknown if the sources do not say how to find it)

## Fix

- Custom Tables: move to `3.7.8` or later

## Timeline

- 2026-11-02T19:24:39+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-105606

## From the sources

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.

---

_Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai_