CVE-2026-21625

High · 8.8

CVSS

8.8

EPSS

0.4%

Published

Jan 16, 2026

CISA due date

—

The record

User provided uploads to the Easy Discuss component for Joomla aren't properly validated. Uploads are purely checked by file extensions, no mime type checks are happening.

Affected packages

Ecosystem	Package	Introduced	Fixed