CVE-2026-48939

What it actually does

The flaw allows an unauthenticated remote attacker to abuse the iCagenda file attachment upload feature in Joomla to upload files with dangerous server-side extensions, including PHP. Because upload validation does not adequately restrict file type, extension, content, or execution context, the attacker can place a web-accessible PHP payload on the server and invoke it over HTTP. Successful exploitation results in remote code execution in the context of the web server/PHP process, enabling command execution, web shell deployment, file modification, data access, credential theft, persistence, and potential lateral movement from the Joomla host.

Why it matters to the business

A public Joomla site running a vulnerable iCagenda extension can be fully compromised without user interaction or authentication. Attackers can deface the site, steal customer or administrative data, install web shells, use the server for phishing or malware delivery, pivot into connected systems, or disrupt availability. This vulnerability is listed in CISA KEV with a remediation due date of 2026-07-13, has high EPSS likelihood, and is reported as actively exploited in the wild, so exposed systems should be treated as urgent incident-response priorities even if no compromise is currently known.

How an attack unfolds

An attacker identifies a Joomla site using the vulnerable iCagenda extension and locates the attachment upload functionality exposed by the component. The attacker submits a crafted multipart/form-data request containing a PHP payload disguised as an allowed attachment or using an extension/content-type bypass. Because the extension does not properly validate and neutralize dangerous uploads, the file is written to a web-accessible location. The attacker then browses directly to the uploaded PHP file, causing the server to execute the payload. From there, the attacker can run commands as the web server user, install a persistent web shell, enumerate Joomla configuration files for database credentials, modify application files, create administrative users, stage additional tooling, exfiltrate data, or use the compromised server as an entry point to the broader environment. Public exploitation activity means opportunistic scanning and automated upload attempts should be expected.

How to fix it

Upgrade the iCagenda extension to a vendor-fixed version as soon as one is available and verify that the installed Joomla extension version is no longer vulnerable. If no fixed version is available, disable or uninstall iCagenda, or at minimum disable the file attachment/upload feature until a fix can be applied. Block execution of PHP and other active content in all upload directories using web server configuration, such as disabling PHP handlers in upload paths or serving uploads from a non-executable storage location. Restrict allowed upload types using a deny-by-default allowlist based on extension, MIME type, and server-side content inspection; randomize stored filenames; and ensure uploaded files are not placed under executable web paths. Remove any unexpected uploaded files, especially PHP or script files, from Joomla media, component, cache, and temporary directories. Because this vulnerability is in KEV and actively exploited, treat exposed systems as potentially compromised and perform compromise assessment before returning them to service.

How to confirm the fix worked

Confirm the installed iCagenda extension version against vendor advisories and package metadata, and ensure it is upgraded, disabled, or removed. Validate that public requests to iCagenda upload endpoints cannot upload files with PHP or other executable extensions. Attempt a safe negative test using a harmless PHP test file such as one containing only a comment or benign marker, and verify the application rejects it, stores it outside the web root, or serves it only as inert text rather than executing it. Inspect web server configuration to confirm PHP execution is disabled in upload directories. Search the web root, Joomla media directories, component directories, tmp directories, and cache directories for recently created PHP files, double-extension files, suspicious image/PHP hybrids, and files with unexpected ownership or timestamps. Review access logs for upload requests followed by direct GET/POST requests to newly uploaded PHP files. After remediation, rescan externally to ensure iCagenda upload functionality is not exploitable and no web shell remains reachable.

Typical attack path

1. Scan the internet or targeted domains for Joomla sites exposing the iCagenda component.
2. Confirm the vulnerable attachment upload workflow is reachable without authentication.
3. Send a crafted multipart/form-data upload request containing a PHP web shell or PHP command-execution payload.
4. Bypass weak validation using a dangerous extension, double extension, misleading MIME type, or crafted filename/content.
5. Locate or infer the uploaded file path from the application response, predictable storage location, or subsequent enumeration.
6. Request the uploaded PHP file over HTTP to trigger code execution.
7. Use the web shell to execute operating system commands under the web server/PHP account.
8. Read Joomla configuration files and harvest database credentials or secrets.
9. Modify site files, create persistence, deploy additional tooling, exfiltrate data, or pivot to adjacent systems.

How to detect it

Check for prior exploitation by correlating web access logs, web server error logs, PHP-FPM logs, Joomla logs, file creation timestamps, EDR telemetry, and WAF events. Focus on POST requests to Joomla/iCagenda component routes or upload-related endpoints, especially multipart/form-data requests with filenames ending in .php, .phtml, .phar, .php5, or double extensions such as .jpg.php. Look for a sequence where an upload request is followed shortly by GET or POST requests to a newly created script under Joomla media, component, cache, tmp, or upload directories. Inspect the filesystem for unexpected PHP files, recently modified Joomla core or extension files, small web shell stagers, obfuscated PHP using eval/base64_decode/gzinflate/assert/shell_exec/system/passthru/proc_open, and files whose timestamps align with suspicious upload requests. Review outbound network connections from the web server after suspicious requests, as successful web shell use often downloads tooling or connects to command-and-control infrastructure. Check Joomla administrative logs for unexpected account creation, extension installation, template modification, configuration changes, or failed login bursts around the suspected exploitation window. If threat-intel naming or campaign labels mention iCagenda unrestricted dangerous-file upload activity, pivot on common web shell behaviors rather than a single actor-specific indicator because exploitation is likely automated and opportunistic.

• option=com_icagenda
• com_icagenda
• multipart/form-data
• filename="*.php"
• filename="*.phtml"
• filename="*.phar"
• filename="*.php5"
• .jpg.php
• .png.php
• .gif.php
• /components/com_icagenda/
• /media/com_icagenda/
• /tmp/
• /cache/
• eval(
• base64_decode(
• gzinflate(
• str_rot13(
• shell_exec(
• passthru(
• proc_open(
• popen(
• system($_
• assert($_
• cmd=
• c99.php
• r57.php
• wso.php
• b374k.php

What your security team should do

• Prioritize all internet-facing Joomla systems using iCagenda for immediate triage because the vulnerability is KEV-listed, actively exploited, and has a high EPSS probability.
• Identify all Joomla installations and determine whether the iCagenda extension is installed, enabled, and externally reachable.
• Upgrade iCagenda to a fixed release when available; if no fixed release is available, disable or remove the extension immediately.
• Temporarily block or restrict access to iCagenda upload functionality at the WAF, reverse proxy, or web server layer until remediation is complete.
• Harden upload directories so PHP and other executable content cannot run, regardless of application-layer validation.
• Perform compromise assessment on exposed systems, including web shell hunting, file integrity review, access-log analysis, and credential exposure review.
• Rotate Joomla administrator credentials, database credentials, API keys, and any secrets stored on hosts where exploitation is suspected or confirmed.
• Add SIEM detections for suspicious iCagenda upload activity, PHP files created in upload paths, and HTTP requests invoking newly uploaded PHP files.
• If compromise is confirmed, preserve forensic evidence, isolate affected hosts, rebuild from trusted media where appropriate, and review lateral movement opportunities from the web server.
• Track the CISA KEV due date of 2026-07-13 as the latest acceptable remediation deadline, not as a target date for high-risk internet-facing systems.