CVE-2026-60025: Joomla Events Booking CSRF Vulnerability

CVE-2026-60025 Overview

CVE-2026-60025 is a Cross-Site Request Forgery (CSRF) vulnerability [CWE-352] in the Joomla extension Events Booking by JoomDonation. Versions prior to 5.8.0 expose a frontend file upload endpoint that lacks CSRF protection. An attacker can craft a malicious page that, when visited by an authenticated user, forces the browser to submit a file upload request without consent. The advisory also references user enumeration behavior in the affected component. Because the endpoint accepts file uploads, successful exploitation can lead to arbitrary file placement on the target Joomla site.

Critical Impact
Attackers can leverage an authenticated victim's session to upload attacker-controlled files to a Joomla site running Events Booking prior to 5.8.0, enabling potential webshell delivery and site compromise.

Affected Products

JoomDonation Events Booking Joomla extension versions prior to 5.8.0
Joomla sites with the Events Booking frontend upload endpoint enabled
Any Joomla deployment relying on the vulnerable Events Booking release for event registration workflows

Discovery Timeline

2026-07-17 - CVE-2026-60025 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-60025

Vulnerability Analysis

The vulnerability resides in the frontend file upload endpoint provided by the Events Booking extension. The endpoint accepts file upload requests but does not verify a Joomla CSRF token (also referred to as a form token) before processing the request. An attacker who hosts a malicious HTML page can embed a form or script that submits a multipart request to the vulnerable endpoint. If a Joomla user with upload permissions visits the page while authenticated, their browser will submit the request with valid session cookies. The server processes the upload as if the user initiated it. The advisory also notes user enumeration in the same component, which allows an attacker to identify valid accounts to target.

Root Cause

The root cause is missing anti-CSRF validation on a state-changing endpoint. Joomla exposes a token API (JSession::checkToken()) intended to be enforced on all form submissions. The Events Booking upload handler did not invoke this check prior to version 5.8.0. Combined with the frontend accessibility of the endpoint, this omission allows cross-origin requests to succeed against authenticated sessions.

Attack Vector

Exploitation requires user interaction. An attacker delivers a link via phishing or embeds a hidden form on a page controlled or influenced by the attacker. When an authenticated Joomla user loads the page, their browser issues the upload request to the target site. The uploaded file lands in the location handled by the Events Booking upload workflow. Depending on file type restrictions and web server configuration, this may enable delivery of executable content or overwriting of existing assets. See the JoomDonation Events Booking product page for component details.

No verified public proof-of-concept code is available for this issue at the time of publication. The vulnerability is described in prose based on the advisory contents.

Detection Methods for CVE-2026-60025

Indicators of Compromise

Unexpected files present in Events Booking upload directories that do not correspond to legitimate event registrations or administrator activity.
Web server access logs showing POST requests to the Events Booking frontend upload endpoint originating from external Referer headers.
Newly created files with executable extensions (.php, .phtml, .phar) within Joomla media or component upload paths.

Detection Strategies

Compare the installed Events Booking version against 5.8.0 by inspecting the extension manifest under Joomla Extensions Manager.
Correlate authenticated user sessions with upload events and flag uploads whose Referer header points to an external domain.
Review Joomla audit logs for file upload actions that lack an associated administrator navigation trail.

Monitoring Recommendations

Enable Joomla's built-in User Actions Log and forward events to a centralized log platform for retention and correlation.
Alert on any write operations to component upload directories outside of scheduled maintenance windows.
Monitor for user enumeration patterns such as repeated requests probing account existence against Events Booking frontend endpoints.

How to Mitigate CVE-2026-60025

Immediate Actions Required

Upgrade the Events Booking extension to version 5.8.0 or later through the Joomla Extensions Manager.
Audit upload directories used by Events Booking for unauthorized files and remove any suspicious artifacts.
Rotate administrator and content-editor credentials if unauthorized uploads are discovered.

Patch Information

JoomDonation addressed the missing CSRF protection in Events Booking version 5.8.0. Administrators should apply the update through the Joomla backend or download the latest release directly from the JoomDonation Events Booking page. Verify the installed version after upgrade under the Extensions Manager view.

Workarounds

Disable the Events Booking frontend upload functionality until the extension can be updated to 5.8.0.
Restrict access to the Events Booking frontend endpoints using a web application firewall rule that enforces a same-origin Referer or Origin header.
Limit user accounts that hold upload privileges to reduce the population of viable CSRF victims.

bash

# Example WAF rule pattern to block cross-origin POSTs to Events Booking upload endpoints
# Enforce that Origin header matches the site's own domain
SecRule REQUEST_METHOD "@streq POST" \
    "chain,deny,status:403,id:1060025,msg:'CVE-2026-60025 CSRF block'"
    SecRule REQUEST_URI "@rx /index\.php\?option=com_eventbooking.*upload" \
        "chain"
        SecRule REQUEST_HEADERS:Origin "!@rx ^https?://your-site\.example($|/)"