CVE-2026-77991: CWE-434 Unrestricted Upload of File with Dangerous Type in joomlaeventmanager.net JEM - Joomla Event Manager extension for Joomla

CVE-2026-77991 is a CWE-434 vulnerability in the Joomla Event Manager extension for Joomla (versions 1.0.0 to 5.0.0). The vulnerability arises because the administrator source model permits uploading files with dangerous types such as PHP scripts without proper restrictions. This unrestricted file upload can be exploited by a privileged user to execute arbitrary code remotely, posing a critical security risk. The CVSS 4.0 score is 9.4, indicating a critical severity with network attack vector, low attack complexity, no user interaction, and high impact on confidentiality, integrity, availability, and security requirements.

Successful exploitation allows a privileged user to upload and execute malicious files remotely, potentially leading to full system compromise. This can result in unauthorized control over the Joomla site, data breaches, and disruption of service.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, restrict administrative access to trusted users only and monitor for suspicious file uploads. Avoid using affected versions in production environments if possible.