Signal is active with 3 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
STABLE
If you run products in this scope, you should treat this CVE as relevant to your environment.
🚨 Critical RCE in Joomla CCK (<8.3.16) CVE-2026-102427 allows unauthenticated arbitrary code execution via site/uploader.php https://devcop95.github.io/cYHBernews giving attackers full server takeover with zero login required. Update immediately! #CyberSecurity #InfoSec #Joomla #RCE https://t.co/DF5AMtdIq8
🚨 CVE-2026-102427 A new security vulnerability has been documented. Details & PoC: 🔗 https://pocbit.org/pocs/cve-2026-102427 #CVE #CyberSecurity #InfoSec #AppSec #Vulnerability #SecurityResearch
A PoC/exploit has been discovered for vulnerability CVE-2026-102427 PT ID: PT-2026-103328 Vendor: Joomla / http://ordasoft.com Product: OrdaSoft Joomla CCK Description: Joomla Extension - http://ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing. References: • https://dbu.gs/vulnerability/PT-2026-103328 • https://github.com/murrez/cve-2026-102427
CVE-2026-102427: OS CCK for Joomla let anyone upload and run PHP with no login. CVSS 10.0. Fixed in 8.3.16, but OrdaSoft's updater still offers 8.3.14, so install it by hand. https://mysites.guru/blog/ordasoft-os-cck-sql-injection/?utm_source=twitter&utm_medium=social https://t.co/QERDWKgfIa
1 of 1 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| App | ordasoft | joomla_cck | - | joomla\! | - |