The Event Gallery extension for Joomla (svenbluege.de) versions 1.0.0 through 6.0.0 suffers from a CSRF vulnerability in its image upload functionality. Because the extension does not verify a CSRF token, an attacker can trick an authenticated user into submitting a request that uploads files to an event, potentially overwriting existing files with the same filename.

An attacker can exploit this vulnerability to upload arbitrary files to an event gallery and overwrite existing files without user interaction or consent. This could lead to unauthorized content modification or defacement. The CVSS 4.0 base score is 5.1 (medium severity), reflecting network attack vector, low complexity, and no user interaction required but requiring high privileges.

No official patch or remediation information is provided. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, users should consider restricting access to the image upload functionality or implementing additional CSRF protections at the application or web server level.