CVE-2026-61424 describes a critical vulnerability in the DJ-Classifieds extension for Joomla, affecting versions 1.0 to 3.11.1. The flaw is an unrestricted file upload vulnerability (CWE-434) that permits unauthenticated attackers to upload files of dangerous types, resulting in full remote code execution on the affected system. The vulnerability requires no authentication, no user interaction, and has a network attack vector with low complexity. The vendor has not provided an official fix or remediation level at the time of this report.

Successful exploitation of this vulnerability allows an unauthenticated attacker to upload malicious files to the Joomla server running the DJ-Classifieds extension, leading to full remote code execution. This compromises the confidentiality, integrity, and availability of the affected system, potentially allowing complete system takeover.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, restrict access to the vulnerable extension, disable file uploads if possible, and monitor for suspicious activity related to file uploads. Avoid exposing the vulnerable Joomla instance to untrusted networks.