External risk intelligence

DJ-Classifieds Arbitrary File Upload Leading to Remote Code Execution

CVE advisorySeverity: CRITICAL (CVSS 9.4)

CVE-2026-105603

DJ-Classifieds is a Joomla extension used to create public-facing classifieds portals. As a web application component designed to handle user-submitted content and listings, it is commonly deployed on public-facing web servers. While it requires authentication, the nature of the product role implies exposure to the public internet in typical deployment scenarios.

Unrestricted File Upload

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory details a critical vulnerability found in a Joomla extension that allows for unauthorized file uploads, potentially leading to complete system compromise. The issue is present in versions prior to 3.11.3 and could enable attackers to execute arbitrary code on affected systems. The main concern is confirming relevance and exposure, as the impact depends on the extension's presence and configuration within your environment.

File upload flaw allows unauthorized system takeover.
Confirms potential for significant operational disruption.
Assess exposure; focus on critical infrastructure.

Attack Path

How an attacker could exploit the issue

An attacker with low-level access can upload a malicious file through the DJ-Classifieds Joomla extension. This vulnerability, present in versions prior to 3.11.3, can allow an attacker to gain remote code execution on the server.

Authenticated access required.
Unprivileged arbitrary file upload.
Leads to remote code execution.

Live Threat

Current exploitation, exposure, and threat context

This vulnerability could allow an unprivileged user to upload arbitrary files when DJ-Classifieds is used with specific configurations, potentially leading to the execution of malicious code on the affected server.

Arbitrary files could be uploaded.
Unprivileged authenticated users may upload files.
Remote code execution could occur.

Operational Fix

Recommended remediation, mitigation, and detection steps

The Joomla extension DJ-Classifieds, used for creating classifieds portals, is susceptible to an authenticated arbitrary file upload vulnerability that can lead to Remote Code Execution. Responsibility for addressing this issue likely falls to the application owners or platform teams managing the Joomla environment, in coordination with security teams. The first practical step involves identifying all instances of DJ-Classifieds, confirming their reachability and business criticality, and then planning remediation based on the assessed risk.

Application owners should manage the issue.
Verify reachability and business criticality.
Plan remediation based on risk.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is the DJ-Classifieds extension?

DJ-Classifieds is a software extension for the Joomla content management system. It provides the functionality to build and manage classifieds portals, allowing websites to host user-submitted listings, advertisements, and marketplace content. Organizations typically deploy this component to enable interactive, public-facing web services.

What does CWE-434 mean for CVE-2026-105603?

CWE-434 refers to an Unrestricted Upload of File with Dangerous Type weakness. In the context of this CVE, it means the extension fails to properly validate the files users are permitted to upload. Because this validation is missing, an attacker can upload malicious scripts, which the server then incorrectly accepts and processes, ultimately leading to remote code execution.

How is this vulnerability triggered?

The flaw is triggered when an authenticated user—even one with low-level, unprivileged access—uploads a malicious file through the DJ-Classifieds extension. This process does not require administrative or high-level credentials to initiate. Simply having the ability to log in and access the upload function is sufficient for the attack to succeed, provided the extension is running a vulnerable version before 3.11.3.

Is my DJ-Classifieds instance at risk?

According to Halo Surface Signal, you should prioritize this if your DJ-Classifieds instance is public-facing. Because this extension is designed to handle user-submitted content and listings, it is commonly deployed on servers reachable via the internet. If your site allows users to log in, an attacker could potentially exploit this interface to gain control over the underlying server.

What should I do to address this CVE?

The primary step is to identify all Joomla environments where DJ-Classifieds is active. Verify the version in use to see if it is prior to 3.11.3. Once identified, evaluate the criticality of those systems to your business operations. Work with your platform team to prioritize patching or restricting access to the affected extension to mitigate the risk of unauthorized file uploads.

References

dj-extensions.com/dj-classifieds

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.