[20250301] - Core - Malicious file uploads via Media Manager
21Vexday Risk Score
No sign of exploitation. No public exploitation artifact known so far.
ssvc Trackcvss 7.1epss 0.5%
exploitation probability
0.5%top 61% of all CVEs
observed exploitation
nono source reports it
Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.
CVSS:4.0/AV:N/AC:L/AT:P/PR:H/UI:N/VC:L/VI:H/VA:L/SC:L/SI:H/SA:L/AU:N
Affected products
Joomla! Project · Joomla! CMS