CVE-2026-48939
iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
Description
CVE-2026-48939 is a critical unrestricted file upload vulnerability in the iCagenda extension for Joomla that allows an unauthenticated attacker to upload arbitrary files through the file attachment feature, ultimately leading to PHP code upload and remote code execution. Because iCagenda does not properly validate the types of files it accepts (CWE-434), an attacker can upload a malicious PHP script and have the web server execute it, taking full control of the affected Joomla site. No credentials or user interaction are required, making this iCagenda vulnerability easy to exploit remotely over the network. CISA has added CVE-2026-48939 to its Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild, and public exploit code is available, so administrators should patch without delay.
KEV Information
CVSS Score
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| joomlic | icagenda | >= 3.2.1, < 3.9.15; >= 4.0.0, < 4.0.8 |
References
- https://www.icagenda.com/(Product)
- https://github.com/Polosss/By-Poloss..-..CVE-2026-48939(Exploit, Third Party Advisory)
- https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/(Third Party Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939(US Government Resource)
- https://www.icagenda.com/docs/changelog/icagenda-3-9-15(Release Notes)
- https://www.icagenda.com/docs/changelog/icagenda-4-0-8(Release Notes)
Weakness Type
CWE-434: Unrestricted Upload of File with Dangerous Type
Unrestricted Upload of File with Dangerous Type occurs when software allows users to upload files without properly validating, restricting, or handling the file types, enabling attackers to upload web shells, scripts, or executables that can run on the server. In the iCagenda extension, the file attachment feature accepts dangerous file types without sufficient validation, so an attacker can upload a PHP file that the server then executes, resulting in remote code execution.
Learn more: CWE-434 — Unrestricted Upload of File with Dangerous Type
Impact Analysis
CVE-2026-48939 carries a CVSS 3.1 score of 9.8 (Critical) and is remotely exploitable over the network with low attack complexity, no authentication, and no user interaction required — a worst-case profile for an internet-facing Joomla site. After uploading and executing a malicious PHP file, an attacker gains sweeping control: Confidentiality (High): all data handled by the site, including the database and event submissions, can be exposed; Integrity (High): site files, content, and configuration can be altered or backdoored; Availability (High): the attacker can disrupt or take the site offline. The scope is unchanged, but remote code execution effectively delivers control of the web application and often the underlying hosting account. With CISA confirming active exploitation, unpatched iCagenda installations are at high risk of compromise and should be remediated immediately.
Exploit Maturity
Public exploit code is available for CVE-2026-48939 via a GitHub proof-of-concept repository, and a third-party advisory documenting the file upload RCE is published at mysites.guru. CISA has added CVE-2026-48939 to the Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild against iCagenda; ransomware usage is currently listed as unknown. The EPSS score of about 1.5% (roughly the 72nd percentile) suggests broad mass exploitation is not yet predicted, but the combination of a public exploit, an unauthenticated CVSS 9.8 flaw, and confirmed KEV status makes this an urgent, act-now item that should be patched before the July 13, 2026 due date.
Remediation
- Follow CISA's KEV required action: apply mitigations in accordance with iCagenda's vendor instructions, ensure compliance with BOD 26-04 patching guidance and CISA's Forensics Triage Requirements, and discontinue use of the product if mitigations are unavailable — the KEV due date is July 13, 2026.
- Upgrade iCagenda to a fixed release: install version 3.9.15 or later on the 3.x branch (affected: >= 3.2.1, < 3.9.15) or version 4.0.8 or later on the 4.x branch (affected: >= 4.0.0, < 4.0.8), per the iCagenda changelog.
- As an interim mitigation aligned with CWE-434 guidance, restrict or disable the file attachment feature, enforce a strict whitelist of allowed file extensions, and validate uploaded files by content (magic bytes/signatures) rather than by extension alone.
- Store uploads outside the web root or in a directory configured so scripts cannot execute, and rename uploaded files to strip original extensions and prevent them from being run as PHP.
- Monitor web server and Joomla logs for suspicious uploads and unexpected PHP files, check for web shells, and treat any exposed, unpatched installation as potentially compromised by performing forensic triage and IOC checks.
Technical Details
The vulnerability is an unrestricted file upload (CWE-434) in the iCagenda Joomla extension: the file attachment feature does not properly validate, restrict, or handle the type of files it accepts, allowing an unauthenticated attacker to upload a PHP script through the attachment mechanism. Because the uploaded file is placed where the web server will interpret it, requesting the file executes the attacker's PHP code, producing full remote code execution. The CVSS 3.1 vector (AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H) reflects a network-reachable, low-complexity attack requiring no privileges and no user interaction, with high impact to confidentiality, integrity, and availability and an unchanged scope. This is the same file-upload-to-RCE class that ranks among the most severe web application vulnerabilities, because a single unauthenticated request bridges the gap between uploading a file and executing arbitrary code.
Frequently Asked Questions
Is CVE-2026-48939 being actively exploited?
Yes. CISA has added CVE-2026-48939 to its Known Exploited Vulnerabilities catalog, confirming active exploitation in the wild against the iCagenda Joomla extension, and public exploit code is available on GitHub. Ransomware use is currently unknown, and the EPSS score of about 1.5% indicates exploitation is targeted rather than widespread mass scanning, though the confirmed KEV status makes it urgent.
What products are affected by CVE-2026-48939?
The vulnerability affects the iCagenda extension for Joomla in versions from 3.2.1 up to (but not including) 3.9.15, and from 4.0.0 up to (but not including) 4.0.8. Sites running any version in those ranges are exposed to unauthenticated remote code execution.
How do I fix CVE-2026-48939?
Upgrade iCagenda to version 3.9.15 or later on the 3.x branch, or 4.0.8 or later on the 4.x branch, in line with CISA's KEV required action and the due date of July 13, 2026. Until you can patch, restrict or disable the file attachment feature, enforce a file-type whitelist, and ensure uploaded files cannot be executed by the web server.
How severe is CVE-2026-48939?
CVE-2026-48939 is rated Critical with a CVSS 3.1 score of 9.8, the highest severity tier. It enables unauthenticated remote code execution with high impact to confidentiality, integrity, and availability; its EPSS score sits around the 72nd percentile, but confirmed active exploitation and available public exploit code make prompt patching essential.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.