A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Critical 9.8Actively exploited
CVE-2026-48939
iCagenda iCagenda — Unrestricted Upload of File with Dangerous Type.
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
WeaknessCWE-434: Arbitrary file upload
Published Updated Source NVD and CISA KEV
CVSS 3.1
9.8
AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploit chance, 30 days
20%
Higher than 97% of all CVEs (EPSS)
Status
Actively exploited
On CISA KEV since 10 Jul 2026
Patch
Unknown
Check the vendor advisory
What happened
What to do
- 01Check whether you run iCagenda, and which version.
- 02Follow the vendor advisory for a fix or a workaround.
- 03Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CISA deadlineUS federal agencies must remediate by
References
Timeline · UTC
- Published to NVD
- Added to CISA KEV
- CISA remediation deadline
- NVD record updated
Also actively exploited