The EDocman extension for Joomla, versions 1.0 up to and including 3.8, contains an unauthenticated blind SQL injection vulnerability (CWE-89). This flaw allows remote attackers to inject malicious SQL commands without requiring any authentication, potentially compromising the confidentiality and integrity of the underlying database. The vulnerability is identified as CVE-2026-57832 and has a CVSS 4.0 base score of 8.7, indicating a high impact with network attack vector, low attack complexity, no privileges required, and no user interaction needed.

Successful exploitation of this vulnerability could allow an attacker to execute arbitrary SQL queries on the backend database, potentially leading to unauthorized data disclosure, data manipulation, or denial of service. Since the vulnerability is unauthenticated and remotely exploitable, it poses a significant risk to affected systems.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. No official fix or temporary workaround has been documented at this time. Users of the EDocman extension for Joomla versions 1.0 through 3.8 should monitor vendor communications for updates and apply patches promptly once available.