Arbitrary file upload in Yootheme.com Zoo Extension For Joomla
CVE-2026-74803
Joomla Extension - yootheme.com - Unauthenticated arbitrary file upload in Zoo < 4.1.64 - The image element accepts arbitrary files when the client-supplied Content-Type falls within the image MIME group.
Vulnerability class: Unrestricted File Upload
Affected products
- Yootheme.com Zoo Extension For Joomla — versions 1.0.0-4.1.63
Weakness classification (CWE)
References
- security@joomla.org (product)