CVE-2026-61900 describes an unauthenticated arbitrary file upload vulnerability in the jDownloads extension for Joomla, versions 4.1.0 to 4.1.5. This vulnerability allows attackers to upload files with dangerous types without any authentication, which can lead to full remote code execution on the affected system. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 4.0 vector indicates network attack vector, no privileges or user interaction required, and high impact on confidentiality, integrity, availability, and security requirements. No official remediation or patch is currently documented.

Successful exploitation of this vulnerability can result in full remote code execution on the Joomla server running the affected jDownloads extension versions. This can lead to complete compromise of the affected system, including unauthorized access, data theft, service disruption, and further network pivoting.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, it is recommended to restrict access to the vulnerable extension, disable file upload functionality if possible, or remove the extension entirely to prevent exploitation.