The iCagenda extension for Joomla contains an unrestricted file upload vulnerability (CWE-434) that permits attackers to upload arbitrary files, including PHP scripts, through the file attachment functionality. Successful exploitation results in remote code execution on the server hosting the vulnerable extension. The vulnerability affects iCagenda versions 3.2.1 up to and including 4.0.7. There is currently no official fix or patch available, and no known exploits in the wild have been reported as of the publication date.

An attacker can upload and execute arbitrary PHP code on the server running the vulnerable iCagenda extension, leading to full compromise of the affected Joomla site. This can result in unauthorized access, data theft, site defacement, or further network pivoting. The CVSS 4.0 base score of 10.0 reflects the critical nature of this vulnerability with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, and availability.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict or disable file upload functionality in the iCagenda extension if possible. Monitor for updates from the vendor and apply patches promptly once available.