CVE-2026-94131 describes an unauthenticated arbitrary file deletion vulnerability in the AcyMailing Enterprise extension for Joomla, affecting versions 1.0.0 through 11.0.5. The flaw arises from improper neutralization of special elements in an SQL command (CWE-89), allowing a subscriber to store a file path in a custom file-type field. When this field is cleared, AcyMailing deletes the file at the stored path without proper validation, enabling deletion of files outside the upload directory, including sensitive files such as configuration.php.

An unauthenticated attacker can delete arbitrary files on the server hosting the Joomla AcyMailing extension, potentially leading to denial of service or compromise of the Joomla installation by deleting critical configuration files. This can disrupt website functionality and may require restoration from backups.

No official patch or remediation information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the affected extension and monitor for suspicious activity related to file deletion attempts.