CVE-2026-74803 is a critical vulnerability in the yootheme.com Zoo extension for Joomla (versions 1.0.0 to 4.1.63) involving unrestricted upload of files with dangerous types. The flaw occurs because the image element improperly validates the client-supplied Content-Type header, allowing arbitrary files to be uploaded if the Content-Type falls within the image MIME group. This upload is unauthenticated, meaning attackers do not need credentials to exploit the issue. The vulnerability is classified under CWE-434 (Unrestricted Upload of File with Dangerous Type). The CVSS 4.0 score is 10.0, indicating critical severity with network attack vector, no required privileges or user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

An attacker can upload arbitrary files without authentication, potentially leading to remote code execution, server compromise, or other severe impacts depending on the uploaded file's nature and server configuration. The vulnerability affects all installations of the Zoo extension for Joomla from version 1.0.0 up to and including 4.1.63.

No official patch or remediation guidance is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the upload functionality and monitor for suspicious uploads if possible.