TI-2026-79272 Aliases CVE-2026-102785 GHSA-8w8j-f6ph-29mm

Unrestricted upload in YOOtheme Pro for Joomla allows code execution

MEDIUM 50CWE-434Published 2026-10-22 · Updated 2026-10-22

Key facts

Attack vector: Network
Privileges required: None
User interaction: None
Attack complexity: Low
Attack requirements: None
Impact type: Code execution
Confidentiality · integrity · availability: High · High · High
Fix status: No fix listed

Attack profile from CVSS 4.0 · CNA. Fix status from CNA. Impact type from CWE-434.

Summary

YOOtheme Pro extension for Joomla versions 5.0.0-5.0.52 contains an unrestricted file upload flaw (CWE-434). Its publicly accessible image transformation handler does not fully bind image operations and the output destination to the request signature, so output can traverse out of the cache directory. An unauthenticated remote attacker can write an attacker-controlled PNG/PHP polyglot to an executable public media directory, which leads to remote code execution.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Description from the CNA

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV

EPSS 0.00772 55th percentileScored 2026-11-07

Fix No fix listed No fixed version in the sources yet

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: None
Automatable: Yes
Technical impact: Total

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
yootheme.com	YOOtheme Pro extension for Joomla	5.0.0-5.0.52	—	No fix listed	CNA

YOOtheme Pro extension for Joomla Vendoryootheme.com Affected 5.0.0-5.0.52 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for YOOtheme Pro extension for Joomla.

Written with Claude Haiku 5.5 from the sources below · 2026-10-28

Timeline

2026-10-22 Threatist record created from CVE-2026-102785
2026-10-22 Title updated · CNA
2026-10-22 CISA SSVC decision points changed
2026-10-22 Alias added: GHSA-8w8j-f6ph-29mm

References

Other 1

https://www.yootheme.com/

TI-2026-52567 Unrestricted file upload in yootheme.com Zoo extension for Joomla CVSS 4.0CRITICAL 10.0
TI-2026-52568 Joomla Extension - yootheme.com - Unauthenticated SQL injection in Zoo < 4.1.64 CVSS 4.0CRITICAL 9.3
TI-2026-53544 Cross-site scripting in yootheme.com Zoo extension for Joomla CVSS 4.0HIGH 8.6
TI-2026-53545 SQL injection in yootheme.com YOOtheme Pro extension for Joomla CVSS 4.0HIGH 8.6
TI-2026-53543 Path traversal in yootheme.com Zoo extension for Joomla CVSS 4.0MEDIUM 6.9
TI-2026-53542 Improper access control in yootheme.com Zoo extension for Joomla CVSS 4.0MEDIUM 6.9

See all 12 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences