Arbitrary file upload in Dj-Extensions.com Dj-Classifieds Extension For Joomla
CVE-2026-61424
Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-Classifieds < 3.11.2 - The Joomla extension DJ-Classifieds is vulnerable to an unauthenticated file upload, leading to full RCE.
Vulnerability class: Unrestricted File Upload
Published · last modified .
EPSS exploit prediction
EPSS: 0.004 (38.7th percentile), scored .
Very low probability of exploitation in the next 30 days; routine patching cadence is appropriate. 39th percentile — 38.7% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.004 · newest: 0.004 · change: 0.000
Affected products
- Dj-Extensions.com Dj-Classifieds Extension For Joomla — versions 1.0-3.11.1
Weakness classification (CWE)
Public proof-of-concept exploits
References
- dj-extensions.com/dj-classifieds (product)
- mysites.guru/blog/dj-classifieds-unauthenticated-file-upload/ (third-party-advisory)
Frequently asked questions
- What is CVE-2026-61424?
- CVE-2026-61424 is a vulnerability in Dj-Extensions.com Dj-Classifieds Extension For Joomla, classified under Unrestricted Upload of File with Dangerous Type. Published 2026-07-20.
- Is CVE-2026-61424 known to be exploited?
- 2 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.