Skip to content
OpenAdvisories
Critical · 10.0 Public exploit CVE-2026-102785 EUVD-2026-108161GHSA-8w8j-f6ph-29mm

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52

Published Oct 22, 2026 · Updated Oct 22, 2026 · Assigned by Joomla

Vendor: yootheme.com Product: YOOtheme Pro extension for Joomla Category: Web / CMS

Description

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

Affected products

VendorProductAffectedFixed
yootheme.com YOOtheme Pro extension for Joomla 5.0.0-5.0.52 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 2 repositories

  • antid00t/CVE-2026-102785 ★ 2 · Oct 24, 2026

    CVE-2026-102785 YOOtheme Pro 5.0.0-5.0.52 │ Unauthenticated RCE Mass Exploit & WAF Bypass

  • al4n4n/CVE-2026-102785 ★ 1 · Oct 27, 2026

    CVE-2026-102785: YOOtheme Pro 5.0.0-5.0.52 unauthenticated RCE via image handler signature reuse + path traversal + JPEG/PHP polyglot. CVSS 10.0. Check script, exploit, detection rules.

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References