---
id: "CVE-2026-117550"
page: "https://infrastack.ai/live/CVE-2026-117550"
kind: "vulnerability"
aliases: ["CVE-2026-117550"]
title: "jDownloads Joomla extension: frontend submissions bypass publication approval"
severity: "high"
cvss: 7.1
epss: null
exploited: false
status: "open"
category: "package"
products: []
ecosystems: []
tags: ["jdownloads", "joomla", "package", "self-hosted"]
not_affected_if: ["frontend-submissions-disabled", "version-4.1.8-or-later"]
published_at: "2026-11-12T18:17:15+00:00"
first_seen_at: "2026-11-12T18:40:37+00:00"
updated_at: "2026-11-12T18:42:48+00:00"
sources: [{"source": "nvd", "url": "https://nvd.nist.gov/vuln/detail/CVE-2026-117550", "first_seen_at": "2026-11-12T18:40:37+00:00"}]
exploit_sources: []
---

# jDownloads Joomla extension: frontend submissions bypass publication approval

Link for people: https://infrastack.ai/live/CVE-2026-117550 (this .md is for agents)

jDownloads, a download manager extension for Joomla, lets manipulated frontend submission parameters skip the intended publication and ownership rules. Files can be published even when automatic publication is disabled, and ownership can be assigned against policy.

_Summary, check and fix written by a model from the sources; labelled as such._

## How to check

- Check the installed jDownloads version in the Joomla extensions manager; versions below `4.1.8` are listed as affected.
- Review whether frontend file submissions are enabled and whether unapproved files appear publicly.

## Fix

- jDownloads: move to `4.1.8` or later (fixed version per the sources).

## Timeline

- 2026-11-12T18:40:37+00:00 nvd https://nvd.nist.gov/vuln/detail/CVE-2026-117550

## From the sources

Joomla Extension - jdownloads.com - Publishing of files without approval in jDownloads < 4.1.8 -  Manipulated frontend submission parameters could bypass the intended publication and ownership rules. In particular, submissions could be published despite automatic publication being disabled, and ownership could be assigned contrary to the intended policy.

---

_Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai_