External risk intelligence

Phoca Downloads Arbitrary File Upload Leading to RCE.

CVE advisorySeverity: CRITICAL (CVSS 9.0)

CVE-2026-57828

The vulnerability exists in a Joomla extension. Joomla is a widely deployed content management system typically hosted on internet-facing web servers. As an extension for such a platform, this component is commonly reachable via the public web in standard deployments.

Unrestricted File Upload

Phoca Download

before 6.1.3

Halo Surface Signal: 4 out of 5 — likely to be public-facing.

External exposure likelihood

Horizon Alert

Summary of the vulnerability and why it matters

This advisory concerns a vulnerability in the Phoca Downloads extension for Joomla, which could allow authenticated users to upload and execute malicious files, potentially leading to full system compromise. The main concern is confirming relevance and exposure.

Unauthenticated users can upload and run harmful files.
This vulnerability could impact widely used Joomla websites.
Confirm if your Joomla instances are affected.

Attack Path

How an attacker could exploit the issue

An attacker with registered user privileges can upload an executable file through the Phoca Downloads extension. This allows them to remotely execute code on the server.

Requires authenticated user access.
Uploads executable files.
Enables remote code execution.

Live Threat

Current exploitation, exposure, and threat context

Registered users of the Joomla extension Phoca Downloads could upload executable files to the system, potentially allowing them to execute arbitrary code. This could occur when an authenticated user with upload privileges successfully exploits the vulnerability.

System data and services.
Authenticated file upload.
Remote code execution.

Operational Fix

Recommended remediation, mitigation, and detection steps

This vulnerability in the Phoca Downloads extension for Joomla impacts registered users, granting them the ability to upload and execute files, leading to Remote Code Execution. Identifying and prioritizing affected instances is critical, with owners needing to confirm exposure and business impact before planning remediation, potentially involving coordination with the vendor.

Application owners should manage this issue.
Verify unpatched Joomla instances first.
Plan vendor-assisted remediation.

Supplementary metadata

CVSS vector

Validate whether this threat affects your internet-facing exposure.

Halo Threat Intelligence helps prioritize remediation with Halo Surface Signal and H/A/L/O context. Start exposure validation with a free external attack surface trial.

Free EASM Trial See How Signal Works

Frequently asked questions

What is Phoca Downloads and how does it relate to Joomla?

Phoca Downloads is an extension designed for the Joomla content management system, serving as a repository manager to help site administrators organize, host, and distribute files to users. Because it integrates directly into the Joomla framework, it often handles user-submitted file uploads and public-facing content downloads, making it a functional component for sites that distribute documents or software.

What does CWE-434 mean regarding CVE-2026-57828?

CWE-434 refers to Unrestricted Upload of File with Dangerous Type. In the context of this CVE, it means the Phoca Downloads extension fails to properly restrict the types of files users are allowed to upload. Because the system does not enforce strict validation, it inadvertently accepts executable files that, once saved, allow an attacker to trigger Remote Code Execution and run commands on the server.

How do attackers trigger this vulnerability?

To exploit this, an attacker must possess a registered user account on the Joomla site that grants them access to the file upload features of the extension. This is not an unauthenticated attack; simply visiting the site anonymously will not work. Once logged in, the attacker uses the extension's intended upload functionality to submit a malicious script that the server then processes and executes.

Is my Joomla site at risk according to Halo Surface Signal?

Halo Surface Signal indicates a high likelihood of risk because this vulnerability affects a Joomla extension. Since Joomla sites are typically deployed on internet-facing web servers to serve public content, extensions like Phoca Downloads are commonly reachable over the public web. If your instance is internet-accessible, the attack surface for this registered-user vulnerability is exposed to any account that can reach the upload interface.

What steps should I take if I use Phoca Downloads?

First, verify your current version of the Phoca Downloads extension to see if it is affected. Since this requires authenticated access, audit your user base to identify accounts with upload privileges. Prioritize reviewing these instances for suspicious activity and coordinate with the vendor or follow their official channels for patches or security configurations that restrict file upload types.

References

Written by Nicholas Merritt

Nicholas Merritt is VP of Security Solutions at Halo Security. With more than 25 years across application security, vulnerability prioritization, and offensive security, he helps teams translate threat data into practical exposure validation and remediation focus. He authors Halo Threat Intelligence CVE advisories using Halo Surface Signal and H/A/L/O context to prioritize internet-facing risk.