CVE-2026-84048

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

  • Published Sep 15, 2026
  • CVSS 6.3 medium
  • 0.5% chance of exploitation in the next 30 days (EPSS)

Affected software

CVE-2026-84048 at the National Vulnerability Database