Threats tagged 'ghsa-x2ch-94w5-cr2g'

CVE-2026-94132 is a critical remote code execution vulnerability in the AcyMailing Enterprise extension for Joomla versions 6.0.0 through 11.0.5. The vulnerability arises because the mailbox action feature saves MIME parts of incoming emails without validating file extensions, allowing attackers to upload dangerous file types such as PHP scripts to a web-accessible directory. This flaw enables an attacker who can send emails to the monitored mailbox to write malicious PHP files into the web root, potentially leading to full system compromise.