Skip to content
OpenAdvisories
Critical · 9.3 CVE-2026-48906 EUVD-2026-32162GHSA-wfvx-j6wj-x7w9

Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla

Published May 27, 2026 · Updated Jun 5, 2026 · Assigned by Joomla

Vendor: tassos.gr Product: Advanced Custom Fields Product: Convert Forms Product: EngageBox Product: Google Structured Data Product: MailChimp Auto-Subscribe Product: Novarain/Tassos Framework (plg_system_nrframework) Product: Smile Pack Product: Tassos Code Snippets

Description

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Affected products

VendorProductAffectedFixed
tassos.gr Novarain/Tassos Framework (plg_system_nrframework) 1.0.0-6.0.1 —
tassos.gr Convert Forms 1.0.0-4.4.12, 5.0.0-5.1.5 —
tassos.gr EngageBox 1.0.0-6.3.11, 7.0.0-7.1.1 —
tassos.gr Google Structured Data 1.0.0-5.6.11, 6.0.0-6.1.9 —
tassos.gr Advanced Custom Fields 1.0.0-2.8.12, 3.0.0-3.1.3 —
tassos.gr Smile Pack 1.0.0-1.2.6, 2.0.0-2.1.0 —
tassos.gr Tassos Code Snippets 1.0.0 —
tassos.gr MailChimp Auto-Subscribe 1.0.0-5.0.5, 5.1.0-5.2.0 —

References