CVE-2026-21628: Templaza Astroid Framework RCE Flaw

CVE-2026-21628 Overview

CVE-2026-21628 is an unrestricted file upload vulnerability in the Templaza Astroid Framework, a template framework for Joomla!. The flaw resides in an improperly secured file management feature that accepts uploads of dangerous file types from unauthenticated users. Attackers can upload executable server-side scripts and trigger remote code execution on the underlying host. The weakness is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact

Unauthenticated remote attackers can achieve full remote code execution on affected Joomla! sites running the Astroid Framework, leading to complete compromise of confidentiality, integrity, and availability.

Affected Products

• Templaza Astroid Framework for Joomla!
• Joomla! sites bundling the Astroid Framework extension
• Templates and themes that depend on the Astroid Framework runtime

Discovery Timeline

• 2026-03-05 - CVE-2026-21628 published to NVD
• 2026-03-13 - Last updated in NVD database

Technical Details for CVE-2026-21628

Vulnerability Analysis

The Astroid Framework exposes a file management feature that does not validate the type, extension, or MIME content of uploaded files. The endpoint is also reachable without authentication, removing any access barrier between the attacker and the upload handler. An attacker can submit a PHP file, a server-side script, or another executable payload directly to the upload endpoint. Once the file is written to a web-accessible directory, the attacker requests it through the web server and the script executes within the Joomla! process context.

The issue is reachable over the network with low attack complexity and no user interaction, which is why the CVSS 4.0 vector reports high impact across confidentiality, integrity, and availability for both the vulnerable system and subsequent systems. Exploitation grants the attacker the privileges of the PHP worker, typically enabling database access, configuration disclosure, webshell persistence, and lateral movement to other tenants on shared hosting.

Root Cause

The root cause is missing server-side validation in the upload handler. The framework trusts client-supplied filenames and content types, does not enforce an allowlist of safe extensions, and does not restrict access to authenticated administrators. Combined, these failures permit arbitrary file write to a location that the web server will execute.

Attack Vector

Attack traffic is a standard HTTP or HTTPS multipart upload request to the vulnerable Astroid Framework endpoint. No credentials, tokens, or prior session state are required. Public technical detail is limited; see the AstroidFrame Security Overview for vendor information.

No verified proof-of-concept code is published for CVE-2026-21628 at the time of writing, so exploitation specifics are described in prose rather than reproduced here.

Detection Methods for CVE-2026-21628

Indicators of Compromise

• Newly created .php, .phtml, .phar, or .inc files under Astroid Framework template directories or Joomla! media/ and images/ paths.
• HTTP POST requests to Astroid file management endpoints from unauthenticated sessions, especially with multipart/form-data bodies.
• Outbound network connections from the PHP-FPM or Apache worker process to unfamiliar hosts shortly after an upload event.
• Unexpected Joomla! administrator accounts, modified configuration.php, or new scheduled tasks following a suspicious upload.

Detection Strategies

• Inspect web server access logs for POST requests to Astroid Framework upload routes that return HTTP 200 without a preceding authenticated session.
• Run file integrity monitoring across Joomla! document roots and alert on the creation of executable script files outside deployment windows.
• Use a web application firewall to flag uploads where the declared content type and the file magic bytes disagree.

Monitoring Recommendations

• Forward Joomla!, PHP, and web server logs to a centralized analytics platform and retain at least 90 days of upload activity.
• Baseline normal child processes of the PHP worker and alert on shell, wget, curl, or python invocations.
• Monitor egress traffic from web servers for connections to known webshell command-and-control infrastructure.

How to Mitigate CVE-2026-21628

Immediate Actions Required

• Disable or remove the Astroid Framework file management feature until a patched release is installed.
• Restrict access to Joomla! administrator and framework upload endpoints with network ACLs, VPN, or HTTP basic authentication.
• Audit Joomla! document roots for unauthorized script files and rotate any credentials stored in configuration.php.

Patch Information

No fixed version is referenced in the NVD record at publication time. Administrators should consult the AstroidFrame Security Overview for vendor advisories and upgrade to the latest Astroid Framework release once an official patch is published.

Workarounds

• Configure the web server to deny execution of PHP and other interpreters under user-writable upload directories.
• Enforce an allowlist of file extensions and validate MIME types in a reverse proxy or web application firewall in front of Joomla!.
• Place the Joomla! site behind authentication or IP allowlisting for any administrative and framework management URLs.

# Apache example: block script execution in Joomla media/upload paths
<Directory "/var/www/joomla/media">
    <FilesMatch "\.(php|phtml|phar|inc)$">
        Require all denied
    </FilesMatch>
    Options -ExecCGI
    RemoveHandler .php .phtml .phar
    RemoveType .php .phtml .phar
</Directory>