CVE-2026-77991: Joomla Event Manager RCE Vulnerability

CVE-2026-77991 Overview

CVE-2026-77991 is an unrestricted file upload vulnerability [CWE-434] in the Joomla Event Manager extension developed by joomlaeventmanager.net. The administrator source model in versions prior to 5.0.1 permits uploading dangerous file types, including PHP scripts. Authenticated administrators can leverage this flaw to write executable code to the web root, resulting in remote code execution on the underlying Joomla server. The issue enables full compromise of the hosting environment through the Joomla back-end.

Critical Impact
An authenticated administrator can upload PHP files through the Event Manager source model and execute arbitrary code on the Joomla host, compromising confidentiality, integrity, and availability.

Affected Products

Joomla Event Manager extension by joomlaeventmanager.net
Joomla Event Manager versions prior to 5.0.1
Joomla installations using the vulnerable administrator source model

Discovery Timeline

2026-08-27 - CVE-2026-77991 published to NVD
2026-08-27 - Last updated in NVD database

Technical Details for CVE-2026-77991

Vulnerability Analysis

The Joomla Event Manager extension exposes an administrator-side source model that accepts file uploads without enforcing a safe file-type allowlist. The upload handler does not reject server-executable extensions such as .php, .phtml, or .phar. An attacker with administrator privileges can submit a crafted PHP payload through the extension interface. Once written into a web-accessible directory, the file executes under the Joomla web server user on any subsequent HTTP request. This transforms an administrator-level configuration surface into a full remote code execution primitive. The flaw is classified under CWE-434: Unrestricted Upload of File with Dangerous Type.

Root Cause

The root cause is missing or insufficient validation in the administrator source model's upload logic. The extension trusts client-supplied file extensions and MIME types instead of enforcing a strict server-side allowlist. No content inspection or executable-extension blocklist prevents PHP files from being stored inside a directory served by the Joomla web root.

Attack Vector

The attack requires an authenticated Joomla account with administrator privileges, exploitable over the network with low complexity. The attacker uses the source model upload feature to place a PHP web shell in a served path. They then request the uploaded file over HTTP to trigger execution. Impact extends beyond the extension because the resulting code runs with the privileges of the Joomla PHP process.

No verified public exploit code is available. Refer to the vendor site
for upgrade guidance: https://www.joomlaeventmanager.net/

Detection Methods for CVE-2026-77991

Indicators of Compromise

Unexpected .php, .phtml, .phar, or .php7 files inside Event Manager upload directories or Joomla images/ and media/ paths.
Administrator session activity followed by writes of executable files under paths served by the Joomla web root.
Outbound connections from the Joomla PHP worker to unfamiliar hosts shortly after an administrator upload event.
Webshell-style query strings such as ?cmd=, ?exec=, or base64-encoded payloads targeting recently created files.

Detection Strategies

Inspect Joomla and web server logs for POST requests to Event Manager administrator endpoints followed by GET requests to newly written PHP files.
Hunt for filesystem writes of scripting-language extensions inside Joomla component directories using EDR file-integrity telemetry.
Correlate administrator logins from atypical geographies or IPs with subsequent file creation events in the Event Manager component.

Monitoring Recommendations

Enable file integrity monitoring on all Joomla component and upload directories.
Forward Joomla access logs, PHP-FPM logs, and web server logs to a centralized log platform for correlation and alerting.
Alert on process execution from the PHP worker that spawns shells such as sh, bash, or cmd.exe.

How to Mitigate CVE-2026-77991

Immediate Actions Required

Upgrade Joomla Event Manager to version 5.0.1 or later on all Joomla instances that host the extension.
Audit the Event Manager upload directories and the wider Joomla web root for unauthorized .php, .phtml, or .phar files and remove any that are not part of the legitimate install.
Rotate all administrator credentials, API tokens, and database passwords if evidence of exploitation is found.
Review recent administrator account activity and disable accounts that show unexpected upload behavior.

Patch Information

The vendor addresses the issue in Joomla Event Manager 5.0.1. Consult the Joomla Event Manager Official Site for the current release, changelog, and upgrade instructions. Apply the patched release across development, staging, and production environments.

Workarounds

Restrict administrator access to the Joomla back-end using IP allowlists at the web server or firewall layer until the patch is applied.
Configure the web server to deny execution of PHP files inside upload directories used by Event Manager.
Enforce multi-factor authentication for every Joomla Super User and Administrator account to reduce the risk of credential-based exploitation.

bash

# Apache: block PHP execution in Joomla upload paths
# Place inside the target upload directory as .htaccess
<FilesMatch "\.(php|phtml|phar|php7|phps)$">
    Require all denied
</FilesMatch>

# Nginx equivalent (server block)
location ~* /images/.*\.(php|phtml|phar|php7|phps)$ {
    deny all;
    return 403;
}