External risk intelligence

AcyMailing Starter Unrestricted File Upload Vulnerability

CVE advisorySeverity: CRITICAL (CVSS 9.8)

CVE-2023-39970

AcyMailing is a newsletter and marketing automation component for the Joomla CMS. Such components are typically installed on web servers to manage public-facing subscription forms and email marketing campaigns, making the application's interface and its upload functions frequently reachable via the public internet as part of normal web site operations.

Unrestricted File Upload

Acyba Acymailing Starter

6.7.0 to 8.5.0

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This vulnerability in the AcyMailing component for Joomla allows an attacker to upload dangerous file types, potentially leading to remote code execution on affected systems. The risk stems from its network-accessible nature and the high severity of the potential impact.

Attackers can upload harmful files.
This could allow unauthorized control.
Confirm if your Joomla sites are affected.

Attack Path

How an attacker could exploit the issue

An attacker can reach this vulnerability by interacting with the AcyMailing component, which is often exposed on public websites. If an attacker can upload a specially crafted file through the component's features, it could lead to the execution of arbitrary code on the server.

No authentication or user interaction needed.
Upload a dangerous file type.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability in AcyMailing could allow an unauthenticated attacker to upload and execute arbitrary code on the server. This could lead to a complete compromise of the Joomla site and potentially other systems hosted on the same server, depending on the server's configuration.

Arbitrary code execution on the server.
Unrestricted file upload to the server.
Complete server compromise.

Operational Fix

Recommended remediation, mitigation, and detection steps

The AcyMailing component for Joomla, particularly the Starter version, is susceptible to a critical vulnerability allowing remote code execution. This issue likely impacts application owners responsible for Joomla sites and potentially platform or infrastructure teams managing the web hosting environment. The immediate priority is to identify all instances of the affected AcyMailing version, assess their internet exposure and business criticality, and then coordinate remediation efforts with the relevant accountable teams, which may include vendor management if relying on a managed service.

Application owners must identify affected sites.
Verify public reachability and criticality.
Plan coordinated remediation with infrastructure.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the AcyMailing component for Joomla?

AcyMailing Starter is a software add-on for the Joomla content management system designed to automate email marketing and newsletter distribution. It integrates directly into your website, providing tools to manage subscriber lists, build marketing campaigns, and handle public-facing subscription forms.

What does CWE-434 mean for CVE-2023-39970?

CWE-434 refers to the Unrestricted Upload of File with Dangerous Type. In the context of this CVE, it means the AcyMailing software fails to properly check or limit the types of files users can upload. Because this validation is missing, an attacker can upload malicious scripts that the server might then execute, granting the attacker unauthorized control over the system.

How does an attacker trigger this vulnerability?

An attacker exploits this by sending a specially crafted file to the AcyMailing component's upload function. Crucially, the system is designed such that no authentication or user interaction is required for the attacker to initiate this upload. Simply having access to the upload interface is enough, meaning the bug is not triggered by standard site navigation but by intentional, malicious submission.

Is my site at risk if it uses AcyMailing?

Halo Surface Signal indicates that because AcyMailing is a marketing tool meant for public interaction, its upload functions are frequently reachable via the public internet. If your site uses an affected version, it is likely exposed. You should consider any installation that faces the internet as potentially reachable by an attacker looking to gain unauthorized access.

How do I respond to this CVE-2023-39970 security alert?

First, audit your Joomla environment to create a complete inventory of all sites running AcyMailing Starter versions 6.7.0 through 8.5.0. Once identified, evaluate which sites are accessible from the internet and prioritize those for updates or configuration changes. Coordinate with your web hosting or infrastructure team to ensure that the component is patched or protected as recommended by the vendor.

References

extensions.joomla.org/extension/acymailing-starter/

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.