VulnSocial

CVE-2026-57828Disclosure(phoca / download)

MEDIUMCVSS 8.8 · HIGH

Exploitation ongoing with high activity in latest observed window (1 mentions)

Immediate actions

  • Patch phoca download systems immediately
  • Assume compromise if assets are exposed
  • Hunt for exploitation attempts and persistence artifacts
  • Increase monitoring for publicly documented tradecraft

Recommended action window: Immediate (within 24h)

NVD description

Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

phoca CVEsBack to dashboard
5.5/ 10 priority

Sources & remediation

Exploit / PoC references
Other references
Weakness type (CWE)
CWE-434

Priority

MEDIUM

Exploitation

ACTIVE

PoC

YES

Patch

AVAILABLE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

  • download

Threat summary

  • Active exploitation appears in 2 classified signals
  • Public PoC is present in monitored signal
  • Patch or workaround signal is available
  • 3 mentions across 2 observed days

What's happening

  • Active exploitation reported across 2 signals
  • PoC mentioned or linked in 1 signal
  • Patch or workaround mentioned in 1 signal
  • Technical details provided in 1 signal
  • Disclosure: 1 classified signal
  • Peaked 1d ago at 2 mentions (2026-07-11); latest day: 1
  • 3 total mentions across 2 days

Affected systems

Vendors
phoca
Products
download

Deep dive

Activity timeline3 mentions / 2d
01122Mentions · 2026-07-11: 2Mentions · 2026-07-12: 1PoC Mentioned / Linked · 2026-07-11: 1Active Exploitation · 2026-07-11: 1Active Exploitation · 2026-07-12: 1Patch / Workaround · 2026-07-11: 1Technical Details · 2026-07-11: 107-1107-12
Signal classification3 categories
Disclosure
133.3%
Patch
133.3%
Active Exploitation
133.3%
Referenced assets3 URLs
Classification over time
DateTotalLabels
2026-07-112
Disclosure1Patch1
2026-07-121
Active Exploitation1
Full discourse3 posts
  • Upwind Security MDR@UpwindMDR
    Patch

    🚨Critical - Two Joomla extension file-upload RCEs disclosed (CVE-2026-57827 & CVE-2026-57828) Two popular Joomla download-manager extensions both have arbitrary file upload → RCE flaws (CWE-434). Their upload handlers fail to validate file types, letting an attacker upload a PHP web shell and fully take over the server. - RSFiles / RSJoomla Download Manager (CVE-2026-57827) - UNAUTHENTICATED, CVSS 10.0, and actively exploited in the wild. Affects 1.0–1.17.11. - Phoca Download (CVE-2026-57828) - authenticated, but only a registered account is needed (trivial where self-registration is on), CVSS 9.0. Affects 1.0–6.1.2. Both are internet-facing site-takeover bugs on a widely deployed CMS. If you run either extension, treat as urgent. 👉Patch RSFiles and Phoca Download to the vendor's fixed releases now, and hunt for unexpected files/web shells in upload dirs - especially for RSFiles, given active exploitation.

    Post summary

    Two Joomla download‑manager extensions expose RCE via arbitrary file upload; one is actively exploited, and urgent patching to vendor releases is required.

    00020150
    300 followersView on X
  • VulDB 🛡@vuldb
    Active Exploitation

    A lot of offensive activities were identified targeting http://phoca.cz Phoca Downloads Plugin (CVE-2026-57828) https://vuldb.com/vuln/377786/cti

    Post summary

    The text reports significant offensive activity targeting CVE‑2026‑57828 on the Phoca Downloads plugin, indicating active exploitation, but provides no PoC, tool, patch, or detailed technical information.

    0000097
    2.3K followersView on X
  • MalwareObserver@MalwareObserver
    Disclosure

    🐛 VULNERABILITIES CVE Notify: 🚨 [CVE-2026-57828](https://mysites.guru/blog/phoca-download-authenticated-file-upload-rce/) The Joo... https://mysites.guru/blog/phoca-download-authenticated-file-upload-rce/ #ZeroDay #PatchManagement #Vulnerability

    Post summary

    The post delivers a CVE announcement with a link to a detailed blog post, but the text itself does not disclose exploit code, active attacks, or mitigation steps.

    0000038
    10 followersView on X
CPE platform detail1 entries

1 of 1 entries

PartVendorProductVersionTarget SWTarget HW
Appphocadownload-joomla\!-

Explore more

Back to dashboardphoca CVEsdownload vulnerabilities