Skip to content
OpenAdvisories
High · 7.1 CVE-2025-22213 EUVD-2025-7602GHSA-3qqq-rj9x-fp8h

[20250301] - Core - Malicious file uploads via Media Manager

Published Mar 11, 2025 · Updated Mar 11, 2025 · Assigned by Joomla

Vendor: Joomla! Project Product: Joomla! CMS Category: Web / CMS

Description

Inadequate checks in the Media Manager allowed users with "edit" privileges to change file extension to arbitrary extension, including .php and other potentially executable extensions.

Affected products

VendorProductAffectedFixed
Joomla! Project Joomla! CMS 4.0.0-4.4.11, 5.0.0-5.2.4 —

Advisories 1

References