CVE-2026-88856: OrdaSoft Joomla Gallery RCE Vulnerability

CVE-2026-88856 Overview

CVE-2026-88856 is an authenticated remote code execution vulnerability in the OrdaSoft Joomla Gallery extension for Joomla versions prior to 6.2.7. The extension's updateOSGallery() function, reachable via task=update_osgallery, reads a JSON request body and invokes the value of the method field as a live PHP function. It passes the package field value as the single argument without any allow-list or is_callable() validation. Any single-argument PHP function is directly reachable, including system, exec, shell_exec, and passthru. The flaw is classified under CWE-94: Improper Control of Generation of Code.

Critical Impact
An authenticated user with privileged access can execute arbitrary operating system commands on the underlying web server, resulting in full site compromise.

Affected Products

OrdaSoft Joomla Gallery extension versions prior to 6.2.7
Joomla installations with the vulnerable OrdaSoft Gallery component enabled
Web servers hosting affected Joomla sites

Discovery Timeline

2026-09-20 - CVE-2026-88856 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88856

Vulnerability Analysis

The vulnerability resides in the updateOSGallery() handler exposed through the Joomla task router. When a client submits a POST request with task=update_osgallery, the handler parses a JSON payload and extracts two attacker-controlled fields: method and package. The method value is treated as a callable function name and invoked directly with package as its argument.

Because no allow-list, is_callable() check, or type validation is performed, an authenticated privileged user can call any PHP function that accepts a single string argument. Passing system, exec, shell_exec, or passthru as the method transforms the endpoint into an operating system command executor. The impact extends beyond the Joomla application to the entire hosting environment.

Root Cause

The root cause is unsanitized dynamic function invocation. The extension trusts JSON input from the request body and uses it to build a callable reference at runtime. This pattern qualifies as Code Injection under [CWE-94] because attacker input directly controls which code path executes.

Attack Vector

Exploitation requires authenticated access with elevated Joomla privileges sufficient to reach the update_osgallery task. The attacker sends a crafted JSON body containing a dangerous function name in method and a shell command string in package. The server executes the command under the web server user context. No user interaction is required beyond the attacker's own authenticated session.

No verified proof-of-concept code is publicly available. Refer to the OrdaSoft Official Website for vendor guidance and technical details.

Detection Methods for CVE-2026-88856

Indicators of Compromise

HTTP POST requests to Joomla endpoints containing task=update_osgallery with JSON bodies referencing system, exec, shell_exec, or passthru in a method field.
Unexpected child processes spawned by the PHP-FPM or web server process, including /bin/sh, bash, or utilities such as wget, curl, or nc.
New or modified PHP files in the Joomla web root, particularly webshells dropped after the request.
Outbound network connections from the web server to previously unseen hosts shortly after update_osgallery traffic.

Detection Strategies

Inspect web server access logs for the task=update_osgallery parameter combined with Content-Type: application/json.
Deploy Web Application Firewall (WAF) rules that block JSON payloads containing dangerous PHP function names as method values.
Correlate authenticated Joomla admin sessions with subsequent shell process execution on the host.

Monitoring Recommendations

Enable process auditing on web servers to record command execution parent-child relationships.
Forward Joomla application logs and web server logs to a centralized analytics platform for long-term retention and searchability.
Alert on any invocation of PHP functions typically associated with command execution from web-facing components.

How to Mitigate CVE-2026-88856

Immediate Actions Required

Upgrade the OrdaSoft Joomla Gallery extension to version 6.2.7 or later on all affected Joomla installations.
Audit Joomla user accounts with elevated privileges and rotate credentials for any account that may have been compromised.
Review web server file systems and databases for unauthorized modifications, webshells, or persistence mechanisms.

Patch Information

The vendor addressed the vulnerability in OrdaSoft Joomla Gallery version 6.2.7. Refer to the OrdaSoft Official Website for release notes and download links. Apply the update through the standard Joomla extension update workflow.

Workarounds

Disable the OrdaSoft Gallery extension until the patched version is installed.
Restrict access to the Joomla administrator interface using network-level controls or IP allow-listing.
Deploy WAF rules that block requests to task=update_osgallery containing dangerous function names in the JSON body.
Enforce PHP disable_functions to remove system, exec, shell_exec, and passthru where operationally feasible.

bash

# Example php.ini hardening to block dangerous callables
disable_functions = system,exec,shell_exec,passthru,proc_open,popen