Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla
Priority MEDIUM 46CWE-284Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- None · High · High
- Fix status
- No fix listed
Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-284.
Summary
The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00267 18th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| tassos.gr | Novarain/Tassos Framework (plg_system_nrframework) | 1.0.0-6.0.1 | — | No fix listed | CNA |
| tassos.gr | Convert Forms | 1.0.0-4.4.12; 5.0.0-5.1.5 | — | No fix listed | CNA |
| tassos.gr | EngageBox | 1.0.0-6.3.11; 7.0.0-7.1.1 | — | No fix listed | CNA |
| tassos.gr | Google Structured Data | 1.0.0-5.6.11; 6.0.0-6.1.9 | — | No fix listed | CNA |
| tassos.gr | Advanced Custom Fields | 1.0.0-2.8.12; 3.0.0-3.1.3 | — | No fix listed | CNA |
| tassos.gr | Smile Pack | 1.0.0-1.2.6; 2.0.0-2.1.0 | — | No fix listed | CNA |
| tassos.gr | Tassos Code Snippets | 1.0.0 | — | No fix listed | CNA |
| tassos.gr | MailChimp Auto-Subscribe | 1.0.0-5.0.5; 5.1.0-5.2.0 | — | No fix listed | CNA |
- Novarain/Tassos Framework (plg_system_nrframework) Vendortassos.gr Affected 1.0.0-6.0.1 Fixed in — No fix listed CNA
- Convert Forms Vendortassos.gr Affected 1.0.0-4.4.12; 5.0.0-5.1.5 Fixed in — No fix listed CNA
- EngageBox Vendortassos.gr Affected 1.0.0-6.3.11; 7.0.0-7.1.1 Fixed in — No fix listed CNA
- Google Structured Data Vendortassos.gr Affected 1.0.0-5.6.11; 6.0.0-6.1.9 Fixed in — No fix listed CNA
- Advanced Custom Fields Vendortassos.gr Affected 1.0.0-2.8.12; 3.0.0-3.1.3 Fixed in — No fix listed CNA
- Smile Pack Vendortassos.gr Affected 1.0.0-1.2.6; 2.0.0-2.1.0 Fixed in — No fix listed CNA
- Tassos Code Snippets Vendortassos.gr Affected 1.0.0 Fixed in — No fix listed CNA
- MailChimp Auto-Subscribe Vendortassos.gr Affected 1.0.0-5.0.5; 5.1.0-5.2.0 Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:tassos:advanced_custom_fields:*:*:*:*:*:joomla\!:*:* | 1.0.0 – 2.8.12; 3.0.0 – 3.1.3 | Vulnerable | Tassos |
| cpe:2.3:a:tassos:convert_forms:*:*:*:*:*:joomla\!:*:* | 1.0.0 – 4.4.12; 5.0.0 – 5.1.5 | Vulnerable | Tassos |
| cpe:2.3:a:tassos:engagebox:*:*:*:*:*:joomla\!:*:* | 1.0.0 – 6.3.11; 7.0.0 – 7.1.1 | Vulnerable | Tassos |
| cpe:2.3:a:tassos:google_structured_data:*:*:*:*:*:joomla\!:*:* | 1.0.0 – 5.6.11; 6.0.0 – 6.1.9 | Vulnerable | Tassos |
| cpe:2.3:a:tassos:mailchimp_auto-subscribe:*:*:*:*:*:joomla\!:*:* | 1.0.0 – 5.0.5; 5.1.0 – 5.2.0 | Vulnerable | Tassos |
| cpe:2.3:a:tassos:smile_pack:*:*:*:*:*:joomla\!:*:* | 1.0.0 – 1.2.6; 2.0.0 – 2.1.0 | Vulnerable | Tassos |
| cpe:2.3:a:tassos:tassos_code_snippets:1.0.0:*:*:*:*:joomla\!:*:* | 1.0.0 | Vulnerable | Tassos |
| cpe:2.3:a:tassos:tassos_framework:*:*:*:*:*:joomla\!:*:* | 1.0.0 – 6.0.1 | Vulnerable | Tassos |
- cpe:2.3:a:tassos:advanced_custom_fields:*:*:*:*:*:joomla\!:*:* Versions 1.0.0 – 2.8.12; 3.0.0 – 3.1.3 Vulnerable ·Tassos
- cpe:2.3:a:tassos:convert_forms:*:*:*:*:*:joomla\!:*:* Versions 1.0.0 – 4.4.12; 5.0.0 – 5.1.5 Vulnerable ·Tassos
- cpe:2.3:a:tassos:engagebox:*:*:*:*:*:joomla\!:*:* Versions 1.0.0 – 6.3.11; 7.0.0 – 7.1.1 Vulnerable ·Tassos
- cpe:2.3:a:tassos:google_structured_data:*:*:*:*:*:joomla\!:*:* Versions 1.0.0 – 5.6.11; 6.0.0 – 6.1.9 Vulnerable ·Tassos
- cpe:2.3:a:tassos:mailchimp_auto-subscribe:*:*:*:*:*:joomla\!:*:* Versions 1.0.0 – 5.0.5; 5.1.0 – 5.2.0 Vulnerable ·Tassos
- cpe:2.3:a:tassos:smile_pack:*:*:*:*:*:joomla\!:*:* Versions 1.0.0 – 1.2.6; 2.0.0 – 2.1.0 Vulnerable ·Tassos
- cpe:2.3:a:tassos:tassos_code_snippets:1.0.0:*:*:*:*:joomla\!:*:* Versions 1.0.0 Vulnerable ·Tassos
- cpe:2.3:a:tassos:tassos_framework:*:*:*:*:*:joomla\!:*:* Versions 1.0.0 – 6.0.1 Vulnerable ·Tassos
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2026-48906
- 2026-10-03 Alias added: GHSA-wfvx-j6wj-x7w9
References
Other 1
More tassos.gr vulnerabilities
- TI-2026-17419 Improper access control in tassos.gr Novarain/Tassos Framework CVSS 4.0CRITICAL 9.5
- TI-2026-53808 Joomla Extension - tassos.gr - Client-controlled validation bypass in Convert Forms… CVSS 4.0MEDIUM 6.9
- TI-2026-85549 Stored XSS in Advanced Custom Fields and Smile Pack for Joomla CVSS 4.0HIGH 7.5
- TI-2026-46852 Information disclosure in tassos.gr Convert Forms extension for Joomla CVSS 4.0HIGH 8.2
- TI-2026-85572 File deletion in tassos.gr Advanced Custom Fields for Joomla CVSS 4.0MEDIUM 6.9
Sources
- CVE-2026-48906 · CVE Program
- CVE-2026-48906 · NVD
- FIRST EPSS
- GHSA-wfvx-j6wj-x7w9 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences