CVE-2026-48939

CRITICAL CISA KEV

CVSS v3.1: 9.8 · EPSS: 0.0150 (71.4 percentile) · CISA KEV: Yes

CISA KEVNetworkNo privilegesNo user interactionUnrestricted UploadVendor advisory ref

Source data as of:

At a glance

Severity
CRITICAL
CVSS
9.8 v3.1 · NVD
EPSS
0.0150 (71.4 percentile) · FIRST.org
CISA KEV
Yes KEV added: 2026-07-10
Type
Unrestricted Upload · NVD CWE
Attack conditions (CVSS vector)
NetworkNo privilegesNo user interaction · Source: NVD Vector
Affected vendors
joomlic
Published
2026-06-20 · Modified: 2026-07-11

CVSS / EPSS / KEV

CVSS v3.1 9.8 / 10 CRITICAL Source: NVD
CVSS v4.0 10.0 / 10 CRITICAL Source: NVD
EPSS 0.0150 71.4 percentile Source: FIRST.org
CISA KEV Yes KEV added: 2026-07-10 Source: CISA

Source — CVSS: NVD · EPSS: FIRST.org · KEV: CISA. Data & Sources

Description

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Record details

CVE ID
CVE-2026-48939
CVSS (v3.1)
9.8 (CRITICAL)
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Exploitability subscore
3.9
Impact subscore
5.9
EPSS
0.0150 (71.4 percentile) — 2026-07-12
CISA KEV
Yes — KEV added: 2026-07-10, Remediation due (CISA): 2026-07-13
Known ransomware use
Unknown
Weakness (CWE)
CWE-434
Affected vendors
joomlic
Affected configurations (CPE)
2
Published
2026-06-20
Modified
2026-07-11
Status
Analyzed

References

Reference URLs as listed by NVD, grouped by a mechanical match on the link's host/pattern. Labels describe the link type only.