CVE-2026-94132 is a CWE-434 vulnerability in the AcyMailing Enterprise extension for Joomla (versions 1.0.0 to 11.0.5). The mailbox action feature improperly handles MIME parts of incoming emails by saving them to the media/com_acym/upload/ directory without validating file extensions. This lack of restriction allows an attacker with the ability to send emails to the monitored mailbox to upload PHP files into the web root, enabling remote code execution.

Successful exploitation allows unauthenticated attackers to execute arbitrary PHP code on the affected server by uploading malicious files via email. This can lead to full system compromise, data theft, or service disruption.

No patch or official fix information is provided in the available data. Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until a fix is available, restrict access to the monitored mailbox and implement email filtering to block malicious attachments.