Arbitrary file upload in Dj-Extensions.com Dj-Classifieds Extension For Joomla
CVE-2026-61424
Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.
Vulnerability class: Unrestricted File Upload
EPSS: 0.004 (37.2th percentile) — read the EPSS interpretation.
Affected products
- Dj-extensions.com Dj-classifieds Extension For Joomla — versions 1.0-3.11.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- security@joomla.org (product)
- security@joomla.org (third-party-advisory)
Frequently asked questions
- What is CVE-2026-61424?
- CVE-2026-61424 is a vulnerability in Dj-Extensions.com Dj-Classifieds Extension For Joomla, classified under Unrestricted Upload of File with Dangerous Type. Published 2026-07-20.
- Is CVE-2026-61424 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.