{"id":"CVE-2026-117551","kind":"vulnerability","aliases":["CVE-2026-117551"],"related":[],"title":"jDownloads Joomla extension: file upload lets attackers run PHP code","description":"Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 -  Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution.","summary":"jDownloads, a download manager extension for Joomla, does not properly validate frontend thumbnail uploads. A user with upload permission can place an executable file on the server and get PHP code to run.","severity":"critical","cvss":10.0,"epss":null,"exploited":false,"exploited_at":null,"products":[],"ecosystems":[],"tags":["jdownloads","joomla","other","php","self-hosted"],"not_affected_if":["jdownloads-4.1.8-or-later","no-frontend-upload-permission"],"how_to_check":"- Check the installed jDownloads version in the Joomla extensions manager and compare it with `4.1.8`.\n- Confirm whether frontend users can upload thumbnails in the jDownloads settings.","fix":"- jDownloads versions below `4.1.8`: move to `4.1.8` or later.","status":"open","published_at":"2026-11-12T18:17:15+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","triaged_at":"2026-11-12T18:42:35+00:00","updated_at":"2026-11-12T18:42:35+00:00","category":"other","confidence":0.7,"triage":{"at":"2026-11-12T18:42:35Z","model":"claude-haiku-5-5","output":{"fix":"- jDownloads versions below `4.1.8`: move to `4.1.8` or later.","reach":"internet","title":"jDownloads Joomla extension: file upload lets attackers run PHP code","impact":"high","summary":"jDownloads, a download manager extension for Joomla, does not properly validate frontend thumbnail uploads. A user with upload permission can place an executable file on the server and get PHP code to run.","audience":"businesses","category":"other","nicknames":[],"who_cares":["joomla","jdownloads","php","self-hosted"],"confidence":0.7,"fix_status":"available","needs_auth":"yes","worst_case":"Attacker runs PHP code on the web server","analyst_note":"","how_to_check":"- Check the installed jDownloads version in the Joomla extensions manager and compare it with `4.1.8`.\n- Confirm whether frontend users can upload thumbnails in the jDownloads settings.","plain_action":"","product_name":"","needs_analyst":false,"not_affected_if":["jdownloads-4.1.8-or-later","no-frontend-upload-permission"],"who_is_affected":"Sites running the jDownloads extension for Joomla below 4.1.8 where frontend users have upload permission. The sources do not say whether the default configuration allows frontend thumbnail uploads. Sites without jDownloads, or with it already at 4.1.8 or later, are not affected.","user_interaction":"no","product_ecosystem":"","needs_special_setup":"unknown","severity_if_unknown":"critical"},"cost_usd":0.000713,"input_tokens":4549,"output_tokens":517,"severity_before":"critical"},"analyst_status":null,"analyst_note":null,"search":"'-117551':13A,16A '-2026':12A,15A '4.1.8':66C 'allow':73C 'attack':7A 'code':10A,54B,89C 'cve':11A,14A 'download':26B 'execut':46B,80C,90C 'extens':3A,28B,58C 'file':4A,47B,62C,81C 'frontend':35B,70C 'get':52B 'host':23B 'insuffici':67C 'jdownload':1A,17B,24B,65C 'jdownloads.com':59C 'joomla':2A,18B,30B,57C 'let':6A 'manag':27B 'permiss':42B,77C 'php':9A,20B,53B,88C 'place':44B,79C 'proper':33B 'rce':60C 'result':86C 'run':8A,56B 'self':22B 'self-host':21B 'server':50B,84C 'thumbnail':36B,71C 'upload':5A,37B,41B,63C,72C,76C 'user':39B,74C 'valid':34B,68C","nicknames":[],"mitigations":[],"who_affected":"Sites running the jDownloads extension for Joomla below 4.1.8 where frontend users have upload permission. The sources do not say whether the default configuration allows frontend thumbnail uploads. Sites without jDownloads, or with it already at 4.1.8 or later, are not affected.","tier":"B","verified":{},"analyst_revisit_at":null,"fix_status":"available","audience":"businesses","plain_action":null,"pkeys":[],"ptokens":[],"labels":["critical","jdownloads","joomla","other","php","selfhosted"],"campaign_type":null,"search_a":"'-117551':13A,16A '-2026':12A,15A 'attack':7A 'code':10A 'cve':11A,14A 'extens':3A 'file':4A 'jdownload':1A 'joomla':2A 'let':6A 'php':9A 'run':8A 'upload':5A","search_b":"'code':54B 'download':26B 'execut':46B 'extens':28B 'file':47B 'frontend':35B 'get':52B 'host':23B 'jdownload':17B,24B 'joomla':18B,30B 'manag':27B 'permiss':42B 'php':20B,53B 'place':44B 'proper':33B 'run':56B 'self':22B 'self-host':21B 'server':50B 'thumbnail':36B 'upload':37B,41B 'user':39B 'valid':34B","search_c":"'4.1.8':66C 'allow':73C 'code':89C 'execut':80C,90C 'extens':58C 'file':62C,81C 'frontend':70C 'insuffici':67C 'jdownload':65C 'jdownloads.com':59C 'joomla':57C 'permiss':77C 'php':88C 'place':79C 'rce':60C 'result':86C 'server':84C 'thumbnail':71C 'upload':63C,72C,76C 'user':74C 'valid':68C","cause_entry":null,"cause_path":null,"disclosures_checked_at":null,"first_public_at":"2026-11-12T18:17:15+00:00","kev":null,"cvss_vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:X","cvss_by":"security@joomla.org","poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-117551","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-117551","severity":null,"published_at":"2026-11-12T18:17:15+00:00","modified_at":"2026-11-12T18:17:15+00:00","first_seen_at":"2026-11-12T18:40:37+00:00","fetched_at":"2026-11-12T18:40:37+00:00","note":null}],"documents":[],"disclosures":[],"exploit_sources":[],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}