A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

The version of the iCagenda extension for the Joomla! application running on the remote host is 3.2.1 prior to 3.9.15 or 4.x prior to 4.0.8. It is, therefore, affected by an arbitrary files upload vulnerability in the file attachment feature, ultimately resulting in PHP code upload and execution.

Note that Nessus has not tested for this issue but has instead relied only on the extension's self-reported version number.

iCagenda for Joomla! before 4.0.8 allows unauthenticated attackers to upload arbitrary files via the component's file upload functionality, leading to remote code execution.

ID	Name	Product	Family	Type	Severity
330625	Joomla! Extension 'iCagenda' 3.2.1 < 3.9.15 / 4.x < 4.0.8 Arbitrary Files Upload	Nessus	CGI abuses	Remote	critical
115297	Joomla! iCagenda < 4.0.8 Arbitrary Files Upload	Web App Scanning	Component Vulnerability	Version Based	critical

Detections

Analytics

CVE-2026-48939

critical

Tenable Plugins

critical

critical