Threat database

CVE-2026-94132 is a critical remote code execution vulnerability in the AcyMailing Enterprise extension for Joomla versions 6.0.0 through 11.0.5. The vulnerability arises because the mailbox action feature saves MIME parts of incoming emails without validating file extensions, allowing attackers to upload dangerous file types such as PHP scripts to a web-accessible directory. This flaw enables an attacker who can send emails to the monitored mailbox to write malicious PHP files into the web root, potentially leading to full system compromise.

A vulnerability in the AcyMailing extension for Joomla versions 6.0.0 through 11.0.5 allows an unauthenticated subscriber to delete arbitrary files on the server. This occurs because a subscriber can store a path in a file-type custom field, which the extension deletes when the field is cleared, including files outside the intended upload folder such as configuration.php. The vulnerability is classified as CWE-89 (SQL Injection) and has a high severity with a CVSS score of 8.3.

Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 - A SQLi vulnerability in AcyMailing component < 10.11.1 for Joomla was discovered. Exploiting this flaw can lead to unauthorized database access and data leakage.