PT-2026-92408 · Unknown · Joomgallery
CVSS v4.0
6.3
Medium
| Vector | AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:A |
Name of the Vulnerable Software and Affected Versions
JoomGallery versions prior to 4.4.2
Description
An unauthenticated arbitrary file upload issue exists via the TUS endpoint. While the endpoint allows files to be uploaded, the attacker cannot control the file name or extension. Achieving code execution through this flaw requires a non-standard server configuration.
Recommendations
Update JoomGallery to version 4.4.2 or later.
Restrict access to the TUS endpoint to minimize the risk of exploitation.
Fix
Improper Access Control
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Joomgallery