CVE-2026-94132: AcyMailing Enterprise RCE Vulnerability

CVE-2026-94132 Overview

CVE-2026-94132 is an unrestricted file upload vulnerability [CWE-434] in the AcyMailing Enterprise extension for Joomla. The flaw exists in the mailbox action feature of AcyMailing Enterprise versions prior to 11.1.0. The extension saves MIME parts of incoming emails to media/com_acym/upload/ without validating file extensions. Any sender who can email the monitored mailbox can write a PHP file directly into the web root. This grants unauthenticated remote code execution on the Joomla host.

Critical Impact
Unauthenticated attackers can achieve remote code execution by emailing a crafted attachment to the monitored mailbox, leading to full web server compromise.

Affected Products

AcyMailing Enterprise extension for Joomla, versions prior to 11.1.0
Joomla installations with the AcyMailing mailbox action feature enabled
Web servers hosting the vulnerable media/com_acym/upload/ directory

Discovery Timeline

2026-09-26 - CVE-2026-94132 published to NVD
2026-09-29 - Last updated in NVD database

Technical Details for CVE-2026-94132

Vulnerability Analysis

AcyMailing Enterprise polls an external mailbox to process bounce messages and inbound email actions. When the extension parses incoming messages, it extracts MIME parts and persists attachments to the media/com_acym/upload/ directory inside the Joomla web root. The vulnerable code path writes attachment payloads to disk using the sender-supplied filename without enforcing an extension allow-list or MIME-type check. An attacker who emails a .php file to the monitored mailbox causes a PHP source file to appear under the public web root. Requesting that file through the web server executes the attacker's code under the Joomla application user. The result is unauthenticated remote code execution, lateral access to the database, and potential pivoting into the hosting environment.

Root Cause

The root cause is missing input validation on uploaded file metadata during mailbox ingestion. The extension trusts the MIME filename and does not deny executable extensions, resulting in an unrestricted file upload condition classified under [CWE-434].

Attack Vector

Exploitation is remote and requires no authentication or user interaction on the Joomla server. The attacker sends an email with a PHP attachment to the mailbox that AcyMailing monitors. Once the extension ingests the message, the PHP file lands in media/com_acym/upload/ and becomes reachable through the web server. A subsequent HTTP request executes the payload.

No verified public exploit code is available at the time of writing. See the AcyMailing Website for vendor-published technical details.

Detection Methods for CVE-2026-94132

Indicators of Compromise

Presence of .php, .phtml, .phar, or other executable script files inside media/com_acym/upload/.
Unexpected inbound emails to the AcyMailing monitored mailbox containing executable attachments.
Web server access logs showing GET or POST requests to files under /media/com_acym/upload/ followed by outbound connections.
New Joomla administrator accounts, modified configuration files, or web shell artifacts in Joomla directories.

Detection Strategies

Inventory the media/com_acym/upload/ directory and alert on any file whose extension is not an expected image, document, or archive type.
Correlate mail server logs with file-creation events on the Joomla host to identify attachment-driven writes.
Deploy web application firewall rules that block HTTP requests resolving to script files inside media upload paths.

Monitoring Recommendations

Enable file integrity monitoring on the Joomla web root, with a priority watch on media/com_acym/upload/.
Forward Joomla, PHP-FPM, and web server logs to a centralized SIEM for rule-based detection of script execution from upload directories.
Monitor outbound connections from the PHP worker process for signs of reverse shells or command-and-control traffic.

How to Mitigate CVE-2026-94132

Immediate Actions Required

Upgrade AcyMailing Enterprise to version 11.1.0 or later on all Joomla installations.
Audit media/com_acym/upload/ for unexpected script files and remove any confirmed web shells.
Rotate Joomla administrator credentials, database passwords, and API tokens if compromise is suspected.
Review the mailbox action configuration and disable the feature until patching is complete.

Patch Information

The vendor addressed the issue in AcyMailing Enterprise 11.1.0. Refer to the AcyMailing Website for release notes and download links. Apply the update through the Joomla extension manager and verify the installed version after upgrade.

Workarounds

Disable the AcyMailing mailbox action feature until the patched version is deployed.
Configure the web server to deny execution of PHP files under media/com_acym/upload/ using an Apache .htaccess rule or an equivalent Nginx location block.
Restrict filesystem permissions on the upload directory so the web server cannot execute files placed there.
Add a mail transport rule that strips executable attachments before messages reach the monitored mailbox.

bash

# Apache: block PHP execution in the AcyMailing upload directory
# Place in media/com_acym/upload/.htaccess
<FilesMatch "\.(php|phtml|phar|php[0-9]+)$">
    Require all denied
</FilesMatch>

# Nginx equivalent inside the server block
location ~* ^/media/com_acym/upload/.*\.(php|phtml|phar)$ {
    deny all;
    return 403;
}