Arbitrary file upload in Themexpert.com Jmedia Extension For Joomla
CVE-2026-60032
The Joomla extension JMedia is vulnerable to an authenticated arbitrary file upload, leading to RCE. Executable uploads/writes possible (incl. polyglot filenames); chmod didn't strip execute bits.
Vulnerability class: Unrestricted File Upload
Affected products
- Themexpert.com Jmedia Extension For Joomla — versions 1.0-1.5.4
Weakness classification (CWE)
References
- security@joomla.org (product)