Vulnerability Description
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
CVSS Score
9.8
CRITICAL
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Joomlic | Icagenda | >= 3.2.1, < 3.9.15 |
Related Weaknesses (CWE)
References
- https://www.icagenda.com/Product
- https://github.com/Polosss/By-Poloss..-..CVE-2026-48939ExploitThird Party Advisory
- https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-US Government Resource
- https://www.icagenda.com/docs/changelog/icagenda-3-9-15Release Notes
- https://www.icagenda.com/docs/changelog/icagenda-4-0-8Release Notes
FAQ
What is CVE-2026-48939?
CVE-2026-48939 is a vulnerability with a CVSS score of 9.8 (CRITICAL). A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
How severe is CVE-2026-48939?
CVE-2026-48939 has been rated CRITICAL with a CVSS base score of 9.8/10. This is considered a critical vulnerability requiring immediate attention.
Is there a patch for CVE-2026-48939?
Check the references section above for vendor advisories and patch information. Affected products include: Joomlic Icagenda.