Threats tagged 'ghsa-657v-94xx-8q7f'

A vulnerability in the AcyMailing extension for Joomla versions 6.0.0 through 11.0.5 allows an unauthenticated subscriber to delete arbitrary files on the server. This occurs because a subscriber can store a path in a file-type custom field, which the extension deletes when the field is cleared, including files outside the intended upload folder such as configuration.php. The vulnerability is classified as CWE-89 (SQL Injection) and has a high severity with a CVSS score of 8.3.