Arbitrary file upload in Acymailing.com Acymailing Enterprise Extension For Joomla

CVE-2026-94132

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root.

Vulnerability class: Unrestricted File Upload

Published · last modified .

EPSS exploit prediction

No EPSS score from FIRST.org yet. New CVEs usually get one within a few days; no score means no signal yet, not low risk. How EPSS works.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2026-94132?
CVE-2026-94132 is a vulnerability in Acymailing.com Acymailing Enterprise Extension For Joomla, classified under Unrestricted Upload of File with Dangerous Type. Published 2026-09-26.
Is CVE-2026-94132 known to be exploited?
1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.