CVE-2026-57828: Phoca Download RCE Vulnerability

CVE-2026-57828 Overview

CVE-2026-57828 is an authenticated arbitrary file upload vulnerability in the Phoca Download extension for Joomla. Registered users can upload executable files through the extension's upload functionality. Attackers leverage this weakness to place server-side scripts on the web root and achieve remote code execution (RCE). The flaw is categorized as improper restriction of dangerous file types [CWE-434].

Any Joomla site that permits self-registration or exposes registered accounts is directly exposed. A successful upload gives the attacker code execution under the web server user, which typically leads to full site compromise and lateral movement into the underlying host.

Critical Impact
Authenticated attackers with a low-privilege Joomla account can upload executable scripts and gain remote code execution on the web server.

Affected Products

Phoca Download extension for Joomla (component phoca:download)
Joomla sites with registered user accounts that expose Phoca Download upload functionality
All versions of Phoca Download prior to the vendor-issued fix

Discovery Timeline

2026-07-11 - CVE-2026-57828 published to the National Vulnerability Database (NVD)
2026-07-14 - Last updated in the NVD database

Technical Details for CVE-2026-57828

Vulnerability Analysis

The Phoca Download extension provides file management and download listing functionality inside Joomla. The extension exposes an upload endpoint accessible to authenticated Joomla users. The upload handler fails to validate file extensions and MIME types against an allowlist before writing files to a web-accessible directory.

An attacker authenticates with a standard registered account, then submits a crafted upload request containing a PHP payload. The server writes the payload into the Phoca Download storage path. Requesting the uploaded file causes the PHP interpreter to execute the attacker-controlled code. This grants command execution under the web server process, exposing the Joomla database, configuration files, and any adjacent applications on the host.

Root Cause

The root cause is unrestricted upload of a file with a dangerous type [CWE-434]. The extension does not enforce a strict extension allowlist, does not verify content type against declared extension, and stores uploads inside a directory where the web server executes scripts. Client-side or superficial server-side checks are bypassable by manipulating the request body.

Attack Vector

The vector is network-based with low privileges required. The attacker needs a valid Joomla account, which is trivial to obtain on sites with open registration. No user interaction is required beyond the attacker's own upload request. Exploitation proceeds by:

Registering or logging in to the target Joomla instance.
Submitting a POST request to the Phoca Download upload handler containing a script file with an executable extension or a double extension.
Retrieving the uploaded file over HTTP to trigger interpreter execution.

Refer to the MySites Guru RCE Analysis for a full technical walkthrough of the request flow and payload placement.

Detection Methods for CVE-2026-57828

Indicators of Compromise

New files with extensions such as .php, .phtml, .phar, or double extensions (for example, .jpg.php) inside the Phoca Download upload directory under the Joomla web root.
HTTP POST requests to Phoca Download upload endpoints from recently created or low-reputation user accounts.
Web server processes (www-data, apache, nginx) spawning shells such as /bin/sh, bash, python, or perl shortly after upload activity.
Outbound network connections initiated by the PHP process to attacker infrastructure.

Detection Strategies

Monitor the Phoca Download storage directory for creation of files with server-executable extensions and alert on any such write.
Correlate authenticated Joomla session activity with subsequent GET requests to files inside the upload directory that return non-static content.
Inspect web server access logs for user agents and IPs that both authenticate and upload within a short window, then immediately request the uploaded artifact.

Monitoring Recommendations

Enable file integrity monitoring on the Joomla document root, with priority on Phoca Download component directories.
Ingest Joomla application logs and web server logs into a centralized analytics platform to enable correlation across authentication, upload, and execution events.
Alert on web server user accounts executing system binaries associated with reconnaissance (id, whoami, uname, nc, curl, wget).

How to Mitigate CVE-2026-57828

Immediate Actions Required

Update the Phoca Download extension to the latest release published by the vendor once available on the Phoca Download Resource Page.
Disable open user registration on Joomla sites that do not require it, and audit existing low-privilege accounts.
Review the Phoca Download upload directory for unexpected files and remove any script artifacts.
Rotate Joomla administrator credentials and database secrets if evidence of exploitation is found.

Patch Information

Administrators should apply the fixed version of the Phoca Download extension distributed through the vendor's official channel. Consult the MySites Guru RCE Analysis and the Phoca Download Resource Page for the current fixed release and installation instructions.

Workarounds

Uninstall or disable the Phoca Download extension until the patched version is applied.
Configure the web server to deny script execution inside the Phoca Download upload directory using .htaccess rules or an equivalent Nginx location block.
Restrict access to the Phoca Download upload endpoint at the web server or WAF layer to trusted administrator IP ranges only.
Enforce a strict extension allowlist at a reverse proxy or WAF for any upload endpoint on the Joomla site.

bash

# Apache: block script execution inside the Phoca Download upload directory
# Place this in the upload folder's .htaccess
<FilesMatch "\.(php|phtml|phar|php3|php4|php5|php7|pht)$">
    Require all denied
</FilesMatch>
php_flag engine off
AddType text/plain .php .phtml .phar