Skip to content
OpenAdvisories
Critical · 9.5 Public exploit CVE-2026-94132 EUVD-2026-87772GHSA-x2ch-94w5-cr2g

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0

Published Sep 26, 2026 · Updated Nov 12, 2026 · Assigned by Joomla

Vendor: Datasolution Product: AcyMailing Enterprise extension for Joomla Category: Web / CMS

Description

Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root.

Affected products

VendorProductAffectedFixed
Datasolution AcyMailing Enterprise extension for Joomla 6.0.0-11.0.5 —

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

  • murrez/CVE-2026-94132 ★ 1 · Sep 26, 2026

    AcyMailing Enterprise for Joomla < 11.1.0: POP3 mailbox actions save MIME attachments without extension checks to media/com_acym/upload/, enabling RCE when an attacker can email the monitored inbox (…

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

References