Arbitrary file upload in Themexpert.com Jmedia Extension For Joomla
CVE-2026-60032
Joomla Extension - themexpert.com - Authenticated arbitrary file upload in JMedia < 1.6.0 - The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits.
Vulnerability class: Unrestricted File Upload
EPSS: 0.004 (34.1th percentile) — read the EPSS interpretation.
Affected products
- Themexpert.com Jmedia Extension For Joomla — versions 1.0-1.5.4
Weakness classification (CWE)
References
- security@joomla.org (product)