CVE-2026-74803: Joomla Zoo Extension File Upload Flaw

CVE-2026-74803 Overview

CVE-2026-74803 is an unauthenticated arbitrary file upload vulnerability in the YOOtheme Zoo extension for Joomla, affecting versions prior to 4.1.64. The image element in the Zoo component accepts arbitrary files whenever the client-supplied Content-Type header falls within the image MIME group. Attackers can bypass file type validation without authentication and upload malicious content to the web server. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Critical Impact
Remote unauthenticated attackers can upload arbitrary files by manipulating only the HTTP Content-Type header, potentially leading to remote code execution on Joomla sites running vulnerable Zoo installations.

Affected Products

YOOtheme Zoo Joomla extension versions prior to 4.1.64
Joomla sites with the Zoo component installed and image upload functionality exposed
Public-facing Joomla instances hosting the vulnerable image element endpoint

Discovery Timeline

2026-08-19 - CVE-2026-74803 published to the National Vulnerability Database (NVD)
2026-08-20 - Last updated in NVD database

Technical Details for CVE-2026-74803

Vulnerability Analysis

The vulnerability resides in the image element handler of the YOOtheme Zoo Joomla extension. The upload handler validates uploaded files by inspecting the Content-Type header sent by the client rather than verifying the file's actual contents or extension against a strict allow-list. When the client-supplied MIME type belongs to the image group (for example image/jpeg, image/png, or image/gif), the handler accepts the payload regardless of the underlying file data. An unauthenticated attacker can craft an HTTP request that sets a permitted image MIME type while attaching an executable server-side script such as a PHP file. Once written to a web-accessible directory, the file can be requested directly to trigger execution under the web server context.

Root Cause

The root cause is improper input validation of uploaded files, tracked as CWE-434. The Zoo image element trusts the Content-Type header, which is fully attacker-controlled. No server-side magic-byte inspection, extension allow-list enforcement, or authentication gate is applied to the endpoint.

Attack Vector

The attack vector is network-based with no privileges or user interaction required. An attacker sends an HTTP POST request to the Zoo image upload endpoint carrying a malicious file body and a spoofed Content-Type: image/* header. The server writes the file to disk under the site's upload directory, after which the attacker requests the file's URL to execute the payload. Successful exploitation grants arbitrary code execution as the web server user, enabling full site compromise, data theft, and lateral movement.

No verified public proof-of-concept code is available. See the YOOtheme Security Overview for vendor guidance.

Detection Methods for CVE-2026-74803

Indicators of Compromise

Unexpected .php, .phar, .phtml, or .jsp files present in Zoo media or upload directories
Web server access logs showing POST requests to Zoo image upload endpoints from unauthenticated sessions
Outbound network connections originating from the web server process to unfamiliar hosts shortly after upload activity
New administrator or user accounts created in Joomla without a corresponding administrative session

Detection Strategies

Inspect HTTP request bodies for mismatches between the declared Content-Type header and actual file magic bytes on upload endpoints
Alert on any request to Zoo upload paths from clients lacking authenticated Joomla session cookies
Baseline the contents of Joomla media/, images/, and Zoo-specific upload directories and alert on new executable extensions

Monitoring Recommendations

Forward web server access and error logs to a centralized analytics platform for correlation across upload and execution events
Enable file integrity monitoring on all Joomla writable directories
Track process creation events on the web server to detect PHP interpreter spawning shells or network utilities

How to Mitigate CVE-2026-74803

Immediate Actions Required

Upgrade the YOOtheme Zoo extension to version 4.1.64 or later on all affected Joomla installations
Audit Zoo upload directories for unauthorized files and remove any suspicious server-side scripts
Rotate all Joomla administrator credentials and API keys if any indicator of compromise is confirmed
Review web server logs from prior to patch deployment for exploitation attempts against Zoo endpoints

Patch Information

The vendor has released Zoo version 4.1.64 addressing the arbitrary file upload flaw. Consult the YOOtheme Security Overview for advisory details and download links. Apply the update through the Joomla extension manager and verify the installed version after upgrade.

Workarounds

Restrict access to Zoo image upload endpoints at the web application firewall (WAF) or reverse proxy layer until patching is complete
Configure the web server to disable script execution within Joomla upload directories using .htaccess rules or equivalent Nginx location blocks
Enforce server-side MIME validation via magic-byte inspection at the WAF for any endpoint accepting file uploads

bash

# Example Apache configuration to disable PHP execution in Joomla upload directories
<Directory "/var/www/joomla/media/zoo">
    <FilesMatch "\.(php|phar|phtml|jsp)$">
        Require all denied
    </FilesMatch>
    php_admin_flag engine off
</Directory>