Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
STABLE
| Date | Total | Labels |
|---|
| 2026-08-19 | 2 | Patch2 |
| 2026-08-22 | 1 | Patch1 |
🚨 Critical Security update for ZOO We fixed 3 vulnerabilities: CVE-2026-74803 – Arbitrary file upload CVE-2026-74804 – SQL injection CVE-2026-75114 – External redirects Update ZOO immediately to ZOO 4.1.64.
Post summary
ZOO released critical patch 4.1.64 to fix three vulnerabilities: arbitrary file upload (CVE-2026-74803), SQL injection (CVE-2026-74804), and external redirects (CVE-2026-75114).
📂 CVE-2026-74803: YOOtheme Zoo < 4.1.64 allows unauthenticated arbitrary file upload. The image element accepts any file when Content-Type falls within the image MIME group. CVSS 10. Patch to 4.1.64 now. #cybersecurity #ciso #vulnerabilities #msp https://secalerts.co/vulnerability/CVE-2026-74803?utm_campaign=x https://t.co/G0SX7Ju6hZ
Post summary
The tweet reports CVE-2026-74803, an unauthenticated arbitrary file upload vulnerability (CVSS 10) in YOOtheme Zoo versions before 4.1.64, and announces that a patch is now available.
🚨Critical - YOOtheme Zoo for Joomla Unauthenticated Arbitrary File Upload (CVE-2026-74803) The Zoo extension for Joomla (by YOOtheme) before 4.1.64 lets its image element accept arbitrary files whenever the client-supplied Content-Type header falls within the image MIME group. Because validation trusts the attacker-controlled Content-Type instead of the real file contents, an unauthenticated attacker can upload a PHP file disguised as an image. On a PHP CMS like Joomla, that leads directly to code execution and full site takeover. It requires no authentication and no user interaction and scores the maximum CVSS 10.0. 👉Upgrade the Zoo extension to 4.1.64, and check internet-facing Joomla sites for suspicious uploaded files/webshells.
Post summary
The post announces a critical unauthenticated arbitrary file upload vulnerability (CVE‑2026‑74803) in YOOtheme Zoo for Joomla, provides technical details and a CVSS 10.0 score, and recommends upgrading to version 4.1.64 for remediation.