CVE-2026-61900: Joomla DJ-jDownloads RCE Vulnerability

CVE-2026-61900 Overview

CVE-2026-61900 is an unauthenticated arbitrary file upload vulnerability in the DJ-jDownloads Joomla extension distributed by dj-extensions.com. The flaw affects versions prior to 4.1.6 and allows remote attackers to upload arbitrary files without authentication. Successful exploitation leads to full remote code execution (RCE) on the underlying web server. The vulnerability is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Remote unauthenticated attackers can upload malicious files to any Joomla site running vulnerable DJ-jDownloads versions and achieve full server compromise.

Affected Products

DJ-jDownloads Joomla extension versions prior to 4.1.6
Joomla installations with the vulnerable jDownloads extension enabled
Web servers hosting affected Joomla deployments

Discovery Timeline

2026-07-20 - CVE-2026-61900 published to NVD
2026-07-23 - Last updated in NVD database

Technical Details for CVE-2026-61900

Vulnerability Analysis

The DJ-jDownloads extension is a download management component for Joomla content management systems. The vulnerability resides in the extension's file upload handler, which fails to enforce authentication and does not validate uploaded file types. Attackers can send crafted HTTP requests to the upload endpoint to place executable files, such as PHP web shells, within the Joomla web root.

Once uploaded, the attacker requests the malicious file through the web server, causing the PHP interpreter to execute the payload. This grants arbitrary command execution under the privileges of the web server process. The impact extends to full compromise of the Joomla application, its database credentials, and any other content hosted on the same server.

Root Cause

The root cause is missing authentication combined with insufficient file type validation on the extension's upload endpoint. The handler accepts requests from anonymous users and does not restrict the uploaded MIME type or file extension. This combination allows dangerous file types, such as .php, to be written to a web-accessible directory.

Attack Vector

The attack vector is network-based and requires no authentication or user interaction. An attacker identifies a Joomla site running DJ-jDownloads below version 4.1.6, then sends a POST request to the vulnerable upload endpoint with a PHP payload. After the file is stored, the attacker invokes it via HTTP to trigger execution and gain a foothold on the server.

No verified proof-of-concept code has been published. Technical details are described in the MySites Guru advisory.

Detection Methods for CVE-2026-61900

Indicators of Compromise

Unexpected .php, .phtml, or .phar files appearing under jDownloads upload directories such as /images/jdownloads/ or /media/jdownloads/
POST requests to jDownloads upload endpoints originating from unauthenticated sessions in Joomla access logs
Outbound network connections from the web server process to unfamiliar IP addresses following upload activity
New Joomla administrator accounts or modified configuration.php timestamps without corresponding admin activity

Detection Strategies

Inspect web server access logs for POST requests to jDownloads component URLs that lack a valid Joomla session cookie
Monitor the Joomla file system for creation of executable script files within media and upload directories
Baseline the DJ-jDownloads component directory contents and alert on additions or modifications outside of update windows

Monitoring Recommendations

Enable web application firewall (WAF) logging for all requests to /index.php?option=com_jdownloads and related URLs
Forward Joomla, PHP-FPM, and web server logs to a centralized log platform for correlation and retention
Alert on child processes such as sh, bash, nc, or python spawned by the web server user (www-data, apache, nginx)

How to Mitigate CVE-2026-61900

Immediate Actions Required

Upgrade DJ-jDownloads to version 4.1.6 or later immediately on all Joomla installations
Audit the jDownloads upload directories for unauthorized files and remove any web shells or unknown scripts
Rotate Joomla administrator credentials and database passwords if compromise is suspected
Review web server access logs for signs of exploitation dating back to the extension's installation

Patch Information

The vendor has released DJ-jDownloads version 4.1.6, which addresses the unauthenticated file upload flaw. Administrators should apply the update through the Joomla Extension Manager. Refer to the jDownloads official site for release notes and download links.

Workarounds

Disable or uninstall the DJ-jDownloads extension until the patch can be applied
Configure the web server to deny execution of PHP files within jDownloads upload directories using .htaccess rules or Nginx location blocks
Deploy a WAF rule to block unauthenticated POST requests targeting jDownloads upload endpoints
Restrict file upload MIME types at the reverse proxy layer to images and archives only

bash

# Apache configuration to block PHP execution in jDownloads upload directory
<Directory "/var/www/joomla/images/jdownloads">
    <FilesMatch "\.(php|phtml|phar|php[0-9])$">
        Require all denied
    </FilesMatch>
    php_flag engine off
</Directory>