IT SBIT Services
Schneeberger
DEEN
CVE tracker

OrdaSoft Joomla CCK: Unauthenticated remote code execution via file upload

CVE-2026-102427Critical 10.0Public exploit

← All vulnerabilities

Summary

OrdaSoft Joomla CCK up to version 8.3.15 contains a file upload flaw in the frontend component route task=getContent that requires no authentication. The extension's file extension allow-list is commented out, so an attacker can upload a PHP-executable file disguised as an image and run code on the web server. Any internet-facing Joomla site with the component installed is exposed. The CVSS v4.0 base score is 10.0 (critical), and a public proof of concept exists.

Affected

  • OrdaSoft Joomla CCK (component com_os_cck) versions 1.0.0 through 8.3.15
  • Default configuration as per the CVE record: unaffected versions are not listed

Fixed in

  • Version 8.3.16 (per the CVE record title; no vendor advisory found to confirm)

Workaround

  • No vendor-documented workaround available.
  • If the component is not needed, uninstall or disable it.
  • Block public access to the component's frontend routes at the web server or WAF until the update is applied.
  • Block PHP execution in upload directories as defense in depth.

Exploitation

  • Public proof of concept: yes, published on GitHub and listed in PoC archives.
  • Known exploited in the wild: no confirmed reports.
  • CISA SSVC assessment in the CVE record: exploitation none, automatable yes, technical impact total.
  • Not listed in the CISA KEV catalog.

Our recommendation

  • Check whether any Joomla site runs com_os_cck, and identify the installed version in the component manifest.
  • Update to version 8.3.16 or later as soon as possible.
  • Search web roots for unexpected PHP files and review recent uploads.
  • Restrict or block access to the component until patched.
  • Also patch CVE-2026-102428 (unauthenticated SQL injection), which is fixed in the same release.
  • Monitor web server logs for requests to the component's frontend routes.

Public exploits

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

Research sources

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:45.

Original description (NVD)

Joomla Extension - ordasoft.com - Unauthenticated Remote Code Execution in OrdaSoft Joomla CCK < 8.3.16 - site/uploader.php is reached through the component’s normal frontend routing (task=getContent), a task with no authentication or ACL check anywhere in the dispatch chain. The handler validates the uploaded file’s content with a real magic-byte MIME check, but the extension allow-list that would otherwise restrict the saved file’s extension was present in the source and commented out. The saved file’s extension was taken directly from the attacker-supplied filename with no validation, and the file was written to a path directly under the Joomla web root that is executed by the PHP handler. An image/PHP polyglot, a file whose header bytes satisfy the MIME check with PHP source appended after, passed the content check while carrying a .php extension of the attacker’s choosing.

NVD references (1)

Sources

The tracker combines official, freely usable data sources – updated continuously:

This product uses data from the NVD API but is not endorsed or certified by the NVD. EPSS data © FIRST.org.

Affected? We can help.

We check whether your systems are affected, install updates and close the gap – continuously with the System Health Checker if you wish.

Get in touchRSS feed