CVE-2026-84048 MEDIUM

CVE-2026-84048: Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2

Vendor Joomgalleryfriends.net
Product JoomGallery extension for Joomla
Weakness CWE-284
Published September 15, 2026
Last update September 19, 2026
View on NVD All CVEs

CVSS base score

6.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A

What the vulnerability does

01Description

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

Key dates

02Disclosure timeline

September 15, 2026 CVE published
September 19, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2025-4431 Featured Image Plus <= 1.6.4 - Missing Authorization to Authenticated (Subscriber+) Featured Image Update CVE-2026-48899 Joomla! Core - [20260515] - Incorrect Access Control in sample data plugins CVE-2026-48906 Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla CVE-2026-60030 Joomla Extension - themexpert.com - Broken Access Control for media management in Quix Page Builder < 6.2.1 CVE-2026-48958 Joomla! Core - [20260712] - Incorrect Access Control in com_fields webservice endpoints