What the vulnerability does
01Description
The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.
CVE-2026-48906
CRITICAL
CVE-2026-48906: Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla
CVSS base score
9.3/10
CVSS vector
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:H/SA:H/AU:Y
Explanation of Vulnerability in Simple Terms
02Summary
The Novarain/Tassos Framework contains an access control flaw that allows attackers to modify or delete data without proper authorization. The vulnerability affects versions 1.0.0 through 6.0.1. An attacker with network access can exploit this to alter site content or disable functionality. Site administrators should update to a patched version when available.
What an attacker can do
03Attacker Capabilities
Modify or delete site data and settings without authorization.
Potential impact on your site
04Site Impact
Attackers can alter or destroy site content, settings, and functionality without your permission.
Conditions required to exploit
05Prerequisites
Network access to the site; no authentication or user interaction required.
Key dates
06Disclosure timeline
May 27, 2026
CVE published
June 5, 2026
Record updated
External resources
07References
Related vulnerabilities
08Related CVE
CVE-2025-6680 Tutor LMS <= 3.8.3 - Missing Authorization to Sensitive Information Exposure
CVE-2026-21627 Extension - tassos.gr - SQL injection and Unauthenticated File Read in Novarain/Tassos Framework v4.10.14 – v6.0.37 for Joomla
CVE-2026-48898 Joomla! Core - [20260513] - Privilege escalation through com_users batch task
CVE-2024-13855 Prime Addons for Elementor <= 2.0.1 - Authenticated (Contributor+) Insecure Direct Object Reference via pae_global_block Shortcode
CVE-2026-21629 Joomla! Core - [20260301] - ACL hardening in com_ajax
