CVE-2026-88857: OrdaSoft Joomla Gallery RCE Vulnerability

CVE-2026-88857 Overview

CVE-2026-88857 is an unrestricted file upload vulnerability [CWE-434] in the OrdaSoft Joomla Gallery extension for Joomla versions prior to 6.2.7. The extension's saveWatermark() function writes uploaded files into a web-accessible directory using the client-supplied filename without validation. An authenticated user with the core.manage privilege can upload a PHP payload disguised with an image Content-Type header. Requesting the uploaded path executes the file on the server, yielding remote code execution in the web server context.

Critical Impact
Authenticated attackers with the core.manage permission can achieve remote code execution on the Joomla host, leading to full site compromise and lateral movement into backend infrastructure.

Affected Products

OrdaSoft Joomla Gallery extension versions prior to 6.2.7
Joomla installations running the vulnerable OrdaSoft Gallery component
Any hosting environment exposing the extension's upload directory to direct web requests

Discovery Timeline

2026-09-20 - CVE-2026-88857 published to NVD
2026-09-22 - Last updated in NVD database

Technical Details for CVE-2026-88857

Vulnerability Analysis

The flaw resides in the saveWatermark() handler of the OrdaSoft Gallery extension. The function accepts an uploaded file through the Joomla administrative interface and copies it to a directory served directly by the web server. No server-side controls constrain what type of file is written to disk.

Because the destination is web-accessible and the filename is preserved verbatim, an attacker can create arbitrary files with executable extensions such as .php, .phtml, or .phar. When Apache, Nginx with PHP-FPM, or LiteSpeed processes a request for the uploaded file, the payload runs with the privileges of the PHP worker process.

Exploitation requires the core.manage Joomla permission. This is a privileged role, but it is commonly granted to editors, content managers, and marketing staff in multi-user Joomla deployments, expanding the attack surface beyond super administrators.

Root Cause

Three independent input validation failures combine to produce the vulnerability. First, the extension performs no extension allowlist check on the uploaded filename. Second, it does not inspect file content or magic bytes to confirm the payload is an image. Third, it applies no filename sanitisation, so the client-supplied name reaches disk untouched. The Content-Type header is trusted implicitly, and attackers control that header.

Attack Vector

The attack proceeds over the network against the Joomla administrator endpoint. An authenticated user with core.manage submits a multipart form upload to the watermark handler. The request body contains PHP source code, and the Content-Type header is set to image/jpeg or image/png to satisfy any client-side hint. The server writes the file using the attacker-supplied name, for example shell.php. The attacker then issues a direct GET request to the resulting path under the extension's upload directory to execute arbitrary commands.

The vulnerability corresponds to CWE-434 (Unrestricted Upload of File with Dangerous Type). No exploit code is publicly documented at the time of publication, and the vulnerability is not listed in the CISA Known Exploited Vulnerabilities catalog.

Detection Methods for CVE-2026-88857

Indicators of Compromise

New files with executable extensions such as .php, .phtml, .phar, or .php7 inside the OrdaSoft Gallery watermark upload directory
Web server access logs showing POST requests to the saveWatermark administrator endpoint followed by GET requests to unusual filenames in the media upload path
Outbound network connections initiated by the PHP worker process to unfamiliar external hosts
Newly created Joomla administrator accounts or unexpected changes to user privileges immediately after suspicious upload activity

Detection Strategies

Alert on file creation events in Joomla media directories where the file extension does not match an allowlisted image type such as .jpg, .png, .gif, or .webp
Correlate authenticated administrator sessions with subsequent unauthenticated GET requests to files created during the same session
Inspect web server logs for HTTP responses returning PHP output from URLs under the OrdaSoft Gallery upload path
Baseline the OrdaSoft Gallery upload directory contents and flag deviations during integrity scans

Monitoring Recommendations

Enable Joomla action logging for all users holding the core.manage permission and forward events to a central log store
Monitor process trees for PHP-FPM or Apache worker processes spawning shells, curl, wget, or system enumeration binaries
Track privilege assignments in Joomla user groups and alert when core.manage is granted to new accounts

How to Mitigate CVE-2026-88857

Immediate Actions Required

Upgrade the OrdaSoft Joomla Gallery extension to version 6.2.7 or later on all Joomla instances
Audit all Joomla accounts assigned the core.manage permission and revoke access from users who do not require it
Inspect the extension's watermark upload directory for unexpected files and remove any non-image artifacts
Rotate Joomla administrator credentials and session tokens if compromise is suspected

Patch Information

The vendor has resolved the vulnerability in OrdaSoft Joomla Gallery 6.2.7. Consult the OrdaSoft Official Website for the current release and upgrade documentation. Apply the update through the Joomla Extensions Manager and verify the installed version after deployment.

Workarounds

Disable the OrdaSoft Gallery extension until the patched version can be installed
Configure the web server to deny execution of PHP files within the extension's upload directory using an .htaccess rule or an Nginx location block that returns a 403 for \.ph(p|tml|ar|[0-9])$
Restrict access to the Joomla administrator interface using IP allowlisting or a VPN, reducing the population of accounts that can reach the vulnerable handler
Deploy a web application firewall rule that blocks multipart uploads containing PHP tags or shebang lines destined for the OrdaSoft endpoint

bash

# Nginx configuration example: deny PHP execution in gallery upload directory
location ~* ^/images/ordasoft/.*\.(php|phtml|phar|php[0-9])$ {
    deny all;
    return 403;
}