CVE-2026-105606

Name of the Vulnerable Software and Affected Versions Custom Tables versions prior to 3.7.8

Description An unauthenticated attacker can upload a polyglot file with a controlled extension to the web-accessible tmp directory of a Joomla site that exposes a public Custom Tables submission form. A polyglot file is a file that can be interpreted as two or more different file formats. The stored path is disclosed in the response, and because the uploaded file is served as static content by default, this allows an attacker to host malicious content, such as phishing or malware pages, under the victim's domain.

Recommendations Update Custom Tables to version 3.7.8 or later.