CVE-2026-61424 describes an unauthenticated arbitrary file upload vulnerability in the DJ-Classifieds Joomla extension versions up to 3.11.1. This vulnerability allows attackers to upload files of dangerous types without restriction, which can be exploited to achieve full remote code execution on the target system. The CVSS 4.0 vector indicates the attack requires no privileges or user interaction and has high impact on confidentiality, integrity, availability, and security requirements. No vendor advisory or patch information is available at this time.

Successful exploitation allows unauthenticated attackers to upload arbitrary files, potentially leading to full remote code execution on the affected Joomla site. This compromises the confidentiality, integrity, and availability of the system, enabling complete control by the attacker.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable extension and consider disabling it if possible to prevent exploitation.