Signal is active with 2 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
NONE
Momentum
NONE
🆕 New CVE unauthenticated arbitrary file upload in custom tables (CVE-2026-105606) Attackers without logins can upload files to a public folder, hosting phishing or malware pages on the site's domain. No patch listed yet https://cve.now/CVE-2026-105606?utm_source=x&utm_medium=social&utm_campaign=cvedotnow&utm_content=critical
Custom Tables for Joomla below 3.7.8: anyone can upload a file to the tmp folder via a public submission form, no login. CVE-2026-105606, 9.5 Critical. Update: https://mysites.guru/blog/custom-tables-3-7-8-unauthenticated-file-upload/?utm_source=twitter&utm_medium=social https://t.co/k9ESCJsGQs