This vulnerability (CWE-434) in Joomla! CMS allows unrestricted upload of SHTML files because the default dangerous file list did not include SHTML extensions. Affected versions include multiple ranges from 1.0.0 to 6.1.2 and 4.0.0 to 4.2.0. If the server executes SHTML files, an attacker could upload malicious SHTML files and achieve code execution. The CVSS 4.0 score is 8.9, indicating a critical severity with network attack vector, low attack complexity, and partial privileges required.

Successful exploitation could allow an attacker with high privileges to upload SHTML files that the server executes, resulting in remote code execution. This could compromise the server and the Joomla! CMS installation.

No patch or official fix information is provided in the input data. Patch status is not yet confirmed — check the Joomla! Project vendor advisory for current remediation guidance. Until a fix is available, administrators should restrict file uploads, especially SHTML files, and configure servers to not execute uploaded SHTML files.