CVE-2026-48939

Description

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

Affected Platforms

Weakness Type

CWE-434, CWE-434

References

• https://www.icagenda.com/
• https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
• https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/
• https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-…
• https://www.icagenda.com/docs/changelog/icagenda-3-9-15
• https://www.icagenda.com/docs/changelog/icagenda-4-0-8