CVE-2026-115451 · Runtime
NO FIX YET · SEE WHAT TO DO
The tassos.gr Advanced Custom Fields extension for Joomla has an improper access control flaw that lets anyone delete images in its Gallery folders. In versions 3.1.7 and 3.1.8 users could also view, remove or save each other's unsaved uploads.
first public Nov 5, 2026 · 1 source
Check it with your coding agent
It checks your repository and tells you if you’re affected, with the fix.
Sites running the Advanced Custom Fields extension or Smile Pack in the affected version ranges on Joomla. The flaw is reachable without logging in, so any public Joomla site with these extensions is exposed to image deletion, and sites on versions outside the listed ranges are not affected.
Not affected if not-installed, unaffected-version
Who cares advanced-custom-fields, joomla, self-hosted, smile-pack, tassos.gr
2.8.13-2.8.15 and 3.1.4-3.1.8.1.2.7-1.2.9 and 2.1.2-2.1.6.Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads.
This page as .md · .json · CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
NVD data is provided by NIST and is public domain. Posts quoted belong to their authors.
Are you affected?
Tell InfraStack what you run. It checks this one, and every next one, against your stack.
Ask from here. InfraStack checks the affected versions against your stack and answers in your inbox.
InfraStack checks the affected versions against your stack and answers in Slack, with the evidence and the fix.