The themexpert.com JMedia extension for Joomla versions 1.0 to 1.5.4 suffers from an authenticated arbitrary file upload vulnerability (CWE-434). Authenticated users can upload files with dangerous types, including executable files and polyglot filenames, because the extension fails to properly sanitize or restrict file uploads and does not correctly remove execute permissions on uploaded files. This vulnerability can lead to remote code execution on the affected system. No official patch or remediation level has been published at this time.

Successful exploitation allows an authenticated attacker to upload and execute arbitrary files on the server running the vulnerable JMedia extension. This can lead to full remote code execution, compromising the confidentiality, integrity, and availability of the affected system. The vulnerability is critical with a CVSS 4.0 score of 9.4, indicating high impact and ease of exploitation given authenticated access.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict authenticated user permissions to only trusted users and consider disabling or removing the vulnerable JMedia extension if possible. Monitor for updates from themexpert.com or Joomla regarding patches or mitigations.