CVE-2026-84048: JoomGallery Unauthenticated File Upload RCE

CVE-2026-84048 Overview

CVE-2026-84048 is an unauthenticated arbitrary file upload vulnerability in the JoomGallery extension for Joomla, distributed by joomgalleryfriends.net. The flaw resides in the TUS (resumable upload protocol) endpoint of JoomGallery versions prior to 4.4.1. Remote attackers can upload arbitrary file content without authentication. However, the attacker does not control the file name or file extension, which limits direct exploitation. Code execution is possible only under non-standard server configurations. The issue is classified under [CWE-284] Improper Access Control.

Critical Impact
Unauthenticated attackers can write arbitrary file content to the server through the TUS upload endpoint, potentially enabling code execution on misconfigured hosts.

Affected Products

JoomGallery extension for Joomla, versions prior to 4.4.1
Distributed by joomgalleryfriends.net
Joomla installations exposing the TUS upload endpoint

Discovery Timeline

2026-09-15 - CVE-2026-84048 published to the National Vulnerability Database
2026-09-16 - Last updated in NVD database

Technical Details for CVE-2026-84048

Vulnerability Analysis

JoomGallery implements the TUS resumable upload protocol to accept large media uploads. The TUS endpoint accepts upload requests without enforcing authentication or authorization checks. Unauthenticated remote attackers can therefore initiate uploads and write arbitrary byte content to the server's storage backend. The scope of impact is constrained because the extension controls the generated file name and extension. Attackers cannot directly place executable scripts unless the web server is configured to execute files based on content sniffing or accepts arbitrary extensions as PHP handlers.

Root Cause

The root cause is missing access control on the TUS endpoint, matching [CWE-284] Improper Access Control. The endpoint fails to validate the requester's session or permission level before accepting POST and PATCH operations defined by the TUS specification. Because JoomGallery assigns names and extensions server-side, integrity impact is limited to file content written under attacker-controlled bytes.

Attack Vector

Exploitation occurs over the network without authentication or user interaction. An attacker issues a TUS Creation request to the vulnerable endpoint, followed by PATCH operations to stream arbitrary content into the created upload resource. The uploaded object lands in the JoomGallery storage directory using a server-assigned name. Code execution is contingent on the web server being configured to execute file types outside the standard image extensions, such as .phar handlers or MIME-based execution.

No verified proof-of-concept code is available. See the JoomGallery Friends Homepage for vendor advisory information.

Detection Methods for CVE-2026-84048

Indicators of Compromise

Unexpected HTTP POST and PATCH requests to JoomGallery TUS upload endpoints from unauthenticated sessions
Presence of unfamiliar files within the JoomGallery upload storage directory
HTTP requests containing TUS protocol headers such as Tus-Resumable, Upload-Length, and Upload-Offset from external sources
Web server access logs showing large payload uploads without a preceding authenticated login

Detection Strategies

Inspect Joomla and web server access logs for TUS protocol traffic originating from unauthenticated clients
Audit the JoomGallery media directory for files whose creation timestamps do not correlate with legitimate administrative activity
Alert on HTTP requests containing the Tus-Resumable header directed at the JoomGallery upload path

Monitoring Recommendations

Enable verbose access logging on the Joomla front controller and correlate uploads with authenticated session identifiers
Monitor filesystem changes in the JoomGallery upload directory using integrity monitoring tooling
Route web server logs to a centralized logging platform for continuous review of upload endpoint activity

How to Mitigate CVE-2026-84048

Immediate Actions Required

Upgrade JoomGallery to version 4.4.1 or later on all Joomla instances
Restrict access to the JoomGallery TUS upload endpoint at the web server or reverse proxy layer until patching is complete
Audit the JoomGallery storage directory for unauthorized files created before the patch was applied
Verify that the web server does not execute non-image extensions from the JoomGallery upload directory

Patch Information

The vendor addressed the issue in JoomGallery version 4.4.1. Administrators should download the update from the JoomGallery Friends Homepage and apply it through the Joomla extension manager. Confirm the installed version after upgrade via the Joomla administrator interface.

Workarounds

Block external access to the TUS endpoint using web server rules or a web application firewall until the update is installed
Configure the web server to deny execution of any file type within the JoomGallery uploads directory
Require authentication in front of the JoomGallery upload path using reverse proxy access controls

bash

# Example nginx configuration to deny script execution in the uploads directory
location ~* ^/images/joomgallery/.*\.(php|phar|phtml|pl|py|jsp|asp|sh|cgi)$ {
    deny all;
    return 403;
}