CVE-2026-57828

EUVD-2026-43167
Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
8.8 HIGH
NETWORK
LOW
LOW
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score
CVSS 3.x
EPSS Score
Percentile: 43.18%
Affected Products (NVD)
VendorProductVersion
phocadownload
𝑥
< 6.1.3
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
https://mysites.guru/blog/phoca-download-authenticated-file-upload-rce/
https://www.phoca.cz/phocadownload