CVE-2026-94131 Overview
CVE-2026-94131 is an unauthenticated arbitrary file deletion vulnerability in the AcyMailing Enterprise extension for Joomla, affecting versions prior to 11.1.0. A subscriber can store an arbitrary path inside a file-type custom field. When the field is cleared, AcyMailing deletes the referenced file from the server. The flaw allows deletion of files outside the designated upload folder, including sensitive files such as configuration.php. Removing configuration.php can place a Joomla site into installation mode, enabling site takeover. The issue is tracked under [CWE-89] in the NVD record, though the described behavior aligns with path traversal and improper access control.
Critical Impact
Unauthenticated attackers can delete arbitrary files on the host, including Joomla's configuration.php, which can lead to full site compromise.
Affected Products
- AcyMailing Enterprise extension for Joomla
- All releases prior to version 11.1.0
- Joomla sites exposing subscriber registration or custom-field submission
Discovery Timeline
- 2026-09-26 - CVE-2026-94131 published to NVD
- 2026-09-29 - Last updated in NVD database
Technical Details for CVE-2026-94131
Vulnerability Analysis
AcyMailing Enterprise supports subscriber custom fields, including a file-type field used to attach uploads to a subscriber profile. The extension stores the uploaded file path in the subscriber record. When a subscriber clears that field, the extension invokes a file-deletion routine against the stored path. The routine does not validate that the path resides inside the designated upload directory and does not enforce authentication on the clearing action. An unauthenticated subscriber can therefore substitute an attacker-controlled path, such as the Joomla configuration.php, and trigger its deletion.
Root Cause
The root cause is missing path validation combined with trust in client-supplied field values. AcyMailing treats the stored field value as an authoritative file reference rather than resolving and canonicalizing the path against an allowlisted upload folder. No ownership or authorization check gates the deletion operation.
Attack Vector
Exploitation requires network access to the Joomla site and the ability to submit subscriber data, which is typically public. The attacker registers or interacts with a subscriber form, injects a path pointing outside the upload directory into the file-type custom field, and then clears the field. AcyMailing performs the deletion server-side. Deleting configuration.php triggers Joomla to display the installer, which can be abused to reconfigure the site against an attacker-controlled database.
No verified proof-of-concept code is published. Refer to the AcyMailing Official Website for vendor technical details.
Detection Methods for CVE-2026-94131
Indicators of Compromise
- Unexpected disappearance of configuration.php or other core Joomla files from the webroot
- Joomla installer page appearing on a previously configured site
- AcyMailing subscriber records containing file-type custom field values with ../ sequences or absolute paths
- Web server logs showing unauthenticated POST requests to AcyMailing subscriber endpoints followed by file-clear operations
Detection Strategies
- Inspect AcyMailing database tables for custom field values referencing paths outside the configured upload directory
- Correlate HTTP requests targeting subscriber update endpoints with filesystem deletion events on the webroot
- Enable PHP file-operation auditing or filesystem integrity monitoring on the Joomla root to flag deletions of configuration and core files
Monitoring Recommendations
- Monitor Joomla and AcyMailing logs for subscriber field submissions containing path traversal patterns
- Alert on any change or removal of configuration.php, .htaccess, and files inside /administrator/
- Track outbound and inbound traffic from systems that suddenly serve the Joomla installer
How to Mitigate CVE-2026-94131
Immediate Actions Required
- Upgrade AcyMailing Enterprise to version 11.1.0 or later on all Joomla instances
- Audit AcyMailing subscriber custom field data for malicious path values and purge suspicious entries
- Verify integrity of configuration.php and restore from backup if deletion is suspected
- Restrict public subscriber registration until the extension is patched
Patch Information
AcyMailing addressed the issue in Enterprise release 11.1.0. Administrators should obtain the update from the AcyMailing Official Website and apply it through the Joomla extension manager. Review release notes to confirm the fix is present before closing the ticket.
Workarounds
- Disable file-type custom fields in AcyMailing subscriber forms until the patch is applied
- Apply strict filesystem permissions so the web server user cannot delete files outside the AcyMailing upload directory
- Place a web application firewall rule to block subscriber submissions containing ../, absolute paths, or references to configuration.php
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
