CVE-2026-105606

The record

Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.

Affected packages

Related vulnerabilities

• CVE-2026-121733 Bagisto before 2.4.5 contains a stored cross-site scripting vulnerability that allows… CWE-434
• CVE-2026-73328 Volmarg Personal Management System through 2.1.0 contains an unrestricted file upload… CWE-434
• CVE-2026-76124 The BuddyBoss App plugin for WordPress is vulnerable to Arbitrary File Upload in all… CWE-434
• CVE-2026-120534 The Advanced Custom Fields: Extended PRO plugin for WordPress is vulnerable to Limited… CWE-434
• CVE-2026-105603 Joomla Extension - dj-extensions.com - Authenticated arbitrary file upload in… CWE-434
• CVE-2026-76010 The Photo Gallery, Sliders, Proofing and Themes – NextGEN Gallery plugin for WordPress is… CWE-434
• CVE-2026-118235 The SimpleForm – Form Maker to Chat Apps with Quiz, Poll and Multi Lead Notifications… CWE-434
• CVE-2026-116512 The Project Manager – AI Powered Project Management, Task Management, Kanban Board & Time… CWE-434