Detections
Analytics
Joomla! iCagenda < 4.0.8 Arbitrary Files Upload
critical Web App Scanning Plugin ID 115297
Synopsis
Joomla! iCagenda < 4.0.8 Arbitrary Files UploadDescription
iCagenda for Joomla! before 4.0.8 allows unauthenticated attackers to upload arbitrary files via the component's file upload functionality, leading to remote code execution.Solution
Upgrade to Joomla! iCagenda version 4.0.8 or later.See Also
Plugin Details
Severity: Critical
ID: 115297
Type: Version Based
Family: Component Vulnerability
Published: 7/17/2026
Updated: 7/17/2026
Scan Template: basic, full, pci, scan
Risk Information
VPR
Risk Factor: Critical
Score: 9.4
Percentile: 99.81
CVSS v2
Risk Factor: Critical
Base Score: 10
Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C
CVSS Score Source: CVE-2026-48939
CVSS v3
Risk Factor: Critical
Base Score: 9.8
Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS Score Source: CVE-2026-48939
CVSS v4
Risk Factor: Critical
Base Score: 10
Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H
CVSS Score Source: CVE-2026-48939
Vulnerability Information
CPE: cpe:2.3:a:joomlic:icagenda:*:*:*:*:-:joomla\\\\\\\!:*:*
Exploit Available: true
Exploit Ease: Exploits are available
Patch Publication Date: 6/12/2026
Vulnerability Publication Date: 6/19/2026
CISA Known Exploited Vulnerability Due Dates: 7/13/2026
Reference Information
CVE: CVE-2026-48939
OWASP: 2010-A4, 2010-A8, 2013-A4, 2013-A7, 2013-A9, 2017-A5, 2017-A9, 2021-A1, 2021-A4, 2021-A6, 2025-A1, 2025-A6
WASC: Improper Input Handling, Insufficient Authorization
CAPEC: 1, 19, 441, 478, 479, 502, 503, 536, 546, 550, 551, 552, 556, 558, 562, 563, 564, 578
DISA STIG: APSC-DV-000460, APSC-DV-002560, APSC-DV-002630
HIPAA: 164.306(a)(1), 164.306(a)(2), 164.312(a)(1), 164.312(a)(2)(i)
ISO: 27001-A.12.6.1, 27001-A.13.1.1, 27001-A.14.1.2, 27001-A.14.1.3, 27001-A.14.2.5, 27001-A.18.1.3, 27001-A.6.2.2, 27001-A.9.1.2, 27001-A.9.4.1, 27001-A.9.4.4, 27001-A.9.4.5
NIST: sp800_53-AC-3, sp800_53-CM-6b, sp800_53-SC-6
OWASP API: 2019-API7, 2023-API8
OWASP ASVS: 4.0.2-1.4.2, 4.0.2-12.5.2, 4.0.2-14.2.1