CVE-2026-100747 Overview
CVE-2026-100747 is a Cross-Site Request Forgery (CSRF) vulnerability in the Event Gallery extension for Joomla, developed by Sven Bluege. The flaw affects all versions prior to 6.5.0. The image upload functionality fails to validate a CSRF token, allowing a third-party site to upload arbitrary files to an event and overwrite existing files that share the same filename. Successful exploitation requires an authenticated user with upload privileges to visit an attacker-controlled page. The weakness is tracked under CWE-352: Cross-Site Request Forgery.
Critical Impact
A remote attacker can coerce an authenticated privileged user into uploading or overwriting image files in Event Gallery, enabling content tampering and potential replacement of legitimate media.
Affected Products
- Event Gallery Joomla extension versions prior to 6.5.0
- Joomla sites that permit authenticated upload access to the Event Gallery extension
- Deployments by svenbluege.de that have not applied the 6.5.0 update
Discovery Timeline
- 2026-09-27 - CVE-2026-100747 published to the National Vulnerability Database
- 2026-09-30 - Last updated in NVD database
Technical Details for CVE-2026-100747
Vulnerability Analysis
The Event Gallery extension exposes an image upload endpoint used by authenticated Joomla users to add media to events. The endpoint does not verify an anti-CSRF token on incoming POST requests. An attacker who hosts a crafted HTML page can trigger a cross-origin form submission from the browser of a logged-in administrator or editor. The browser attaches the victim's Joomla session cookies to the request, and the extension processes the upload as if the user had initiated it.
Because the upload handler writes files under their submitted name, an attacker can also overwrite existing images in the gallery when the names collide. This provides a path for defacement, replacing event imagery with attacker-controlled content, or substituting benign images with files containing misleading or malicious content served to site visitors.
Root Cause
The root cause is the absence of a CSRF token check on the image upload action, which Joomla normally enforces using the JSession::checkToken() or Session::checkToken() API. Without that validation, the extension treats any authenticated request as legitimate regardless of origin.
Attack Vector
Exploitation is network-based and requires no user interaction beyond visiting a malicious page while authenticated to the target Joomla site. The attacker crafts a page containing an auto-submitting multipart form that posts to the vulnerable Event Gallery upload URL. See the extension developer's site for product details and the official 6.5.0 release.
Detection Methods for CVE-2026-100747
Indicators of Compromise
- Unexpected image files appearing in Event Gallery event directories outside of normal editorial workflows.
- Overwritten gallery image files with mismatched creation and modification timestamps.
- Web server access logs showing POST requests to the Event Gallery upload endpoint with Referer headers pointing to unrelated external domains.
Detection Strategies
- Correlate Joomla user session activity with web server logs to identify uploads that did not originate from an authenticated administrative page.
- Alert on POST requests to Event Gallery upload paths where the Origin or Referer header is absent or external to the Joomla site.
- Monitor filesystem changes under the Event Gallery media directories using file integrity monitoring.
Monitoring Recommendations
- Enable Joomla's built-in action logging and forward logs to a centralized SIEM for retention and search.
- Baseline normal upload volume per user and alert on anomalies that may indicate CSRF-driven activity.
How to Mitigate CVE-2026-100747
Immediate Actions Required
- Upgrade the Event Gallery extension to version 6.5.0 or later on all Joomla installations.
- Audit event galleries for unexpected or overwritten images since the extension was deployed.
- Rotate credentials for any administrator accounts that may have been tricked into visiting untrusted external pages.
Patch Information
The vendor addressed the issue in Event Gallery 6.5.0 by adding a CSRF token check on the image upload handler. Refer to the Sven Bluege Personal Website for release information and download links.
Workarounds
- Restrict Event Gallery upload permissions to a minimal set of trusted user groups until the upgrade is applied.
- Deploy a web application firewall rule that rejects POST requests to the Event Gallery upload endpoint when the Referer or Origin header is missing or does not match the site domain.
- Instruct privileged users to log out of Joomla sessions when not actively administering the site.
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
