CVE-2026-60025 is a Cross-Site Request Forgery (CWE-352) vulnerability affecting the Events Booking extension for Joomla by joomdonation.com. Specifically, versions before 5.8.0 contain a frontend file upload endpoint that does not implement CSRF protections. This allows an attacker to trick an authenticated user into submitting unwanted requests, potentially leading to unauthorized file uploads and full compromise of the affected system's confidentiality, integrity, and availability. The vulnerability has a CVSS v3.1 base score of 8.8, reflecting network attack vector, low attack complexity, no privileges required, user interaction required, unchanged scope, and high impact on confidentiality, integrity, and availability.

Successful exploitation can lead to unauthorized file uploads via forged requests, resulting in full compromise of confidentiality, integrity, and availability of the affected Joomla extension and potentially the hosting environment. This can enable attackers to execute arbitrary code, deface websites, or disrupt service.

No official patch or remediation level is currently confirmed for this vulnerability. Users should check the vendor advisory for updates and apply any official fixes once available. Until then, consider disabling or restricting access to the vulnerable file upload endpoint or implementing custom CSRF protections as a temporary mitigation.