CVE-2026-94131 HIGH

CVE-2026-94131: Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

Vendor Acymailing.com
Product AcyMailing extension for Joomla
Weakness CWE-89 · SQLi
Published September 26, 2026
Last update September 29, 2026
View on NVD All CVEs

CVSS base score

8.3/10
Attack vector Network
Attack complexity Low
Privileges required None
User interaction None
Confidentiality —
Integrity —

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:H/VA:H/SC:N/SI:N/SA:N

What the vulnerability does

01Description

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.

Key dates

02Disclosure timeline

September 26, 2026 CVE published
September 29, 2026 Record updated

Related vulnerabilities

04Related CVE

CVE-2026-73392 WordPress Super Store Finder plugin <= 7.8 - SQL Injection vulnerability CVE-2026-73187 WordPress Sticky Chat Widget plugin <= 1.4.2 - SQL Injection vulnerability CVE-2026-78070 Joomla Extension - digital-peak.com - Authenticated, privileged blind SQL injection in DP Calendar 5.5.0 - 10.11.2 CVE-2026-78072 Joomla Extension - Jefferson49 - Unauthenticated blind SQLi in Sexy Polling Reloaded < 5.6.1 CVE-2026-66478 WordPress Church Admin plugin <= 5.1.1 - SQL Injection vulnerability