Read the docs
TI-2026-36197 Aliases CVE-2026-48939GHSA-4rh3-rmh3-hv6h

Joomla Extension - icagenda.com - Remote Code Execution in iCaganda extension for Joomla < 4.0.8/3.9.15

Priority CRITICAL 100Exploited in the wildCWE-434Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Code execution
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Why it matters now

Exploitation Active In CISA KEV since 2026-07-10CISA due date 2026-07-13
EPSS 0.20069 97th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Active
Automatable
Yes
Technical impact
Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
icagenda.comiCagenda extension for Joomla3.2.1-4.0.7—No fix listedCNA
  • iCagenda extension for Joomla Vendoricagenda.com Affected 3.2.1-4.0.7 Fixed in — No fix listed CNA

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:joomlic:icagenda:*:*:*:*:-:joomla\!:*:*3.2.1 to before 3.9.15; 4.0.0 to before 4.0.8VulnerableJoomlic
  • cpe:2.3:a:joomlic:icagenda:*:*:*:*:-:joomla\!:*:* Versions 3.2.1 to before 3.9.15; 4.0.0 to before 4.0.8 Vulnerable ·Joomlic

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-07-10 Added to CISA KEV
  2. 2026-10-02 Threatist record created from CVE-2026-48939
  3. 2026-10-03 Alias added: GHSA-4rh3-rmh3-hv6h

References

Exploit 1

Advisory 1

Other 1

  • TI-2026-47661 SQL injection in icagenda.com iCagenda extension for Joomla CVSS 4.0CRITICAL 9.2
  • TI-2026-81945 Stored cross-site scripting in iCagenda Joomla extension CVSS 4.0HIGH 8.6
  • TI-2026-53168 Cross-site scripting in icagenda.com iCagenda extension for Joomla CVSS 4.0HIGH 8.6
  • TI-2026-50140 SQL injection in icagenda.com iCagenda extension for Joomla CVSS 4.0HIGH 8.6
  • TI-2026-81946 CSV formula injection in iCagenda Joomla extension exports CVSS 4.0MEDIUM 5.3
  • TI-2026-50139 Improper access control in icagenda.com iCagenda extension for Joomla CVSS 4.0MEDIUM 5.1

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences