A high-severity remote code execution (RCE) vulnerability exists in the Joomla extension StageIt versions 1.0 through 5.7.5 and 6.0 through 6.3.5. The flaw involves setting strings that can lead to code execution. This vulnerability is tracked as CVE-2026-105600 with a CVSS 4.0 base score of 8.6.