Vulnerability Details CVE-2026-48939
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.243
EPSS Ranking 97.6%
CVSS Severity
CVSS v3 Score 9.8
Proposed Action
iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Ransomware Campaign
Unknown
References
- https://www.icagenda.com/
- https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
- https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939
- https://www.icagenda.com/docs/changelog/icagenda-3-9-15
- https://www.icagenda.com/docs/changelog/icagenda-4-0-8
Products affected by CVE-2026-48939
-
cpe:2.3:a:joomlic:icagenda:3.2.1
-
cpe:2.3:a:joomlic:icagenda:3.8.0
-
cpe:2.3:a:joomlic:icagenda:3.8.1
-
cpe:2.3:a:joomlic:icagenda:3.8.10
-
cpe:2.3:a:joomlic:icagenda:3.8.11
-
cpe:2.3:a:joomlic:icagenda:3.8.13
-
cpe:2.3:a:joomlic:icagenda:3.8.14
-
cpe:2.3:a:joomlic:icagenda:3.8.15
-
cpe:2.3:a:joomlic:icagenda:3.8.16
-
cpe:2.3:a:joomlic:icagenda:3.8.17
-
cpe:2.3:a:joomlic:icagenda:3.8.18
-
cpe:2.3:a:joomlic:icagenda:3.8.19
-
cpe:2.3:a:joomlic:icagenda:3.8.2
-
cpe:2.3:a:joomlic:icagenda:3.8.20
-
cpe:2.3:a:joomlic:icagenda:3.8.21
-
cpe:2.3:a:joomlic:icagenda:3.8.22
-
cpe:2.3:a:joomlic:icagenda:3.8.23
-
cpe:2.3:a:joomlic:icagenda:3.8.24
-
cpe:2.3:a:joomlic:icagenda:3.8.3
-
cpe:2.3:a:joomlic:icagenda:3.8.4
-
cpe:2.3:a:joomlic:icagenda:3.8.5
-
cpe:2.3:a:joomlic:icagenda:3.8.6
-
cpe:2.3:a:joomlic:icagenda:3.8.7
-
cpe:2.3:a:joomlic:icagenda:3.8.8
-
cpe:2.3:a:joomlic:icagenda:3.8.9
-
cpe:2.3:a:joomlic:icagenda:3.9.0
-
cpe:2.3:a:joomlic:icagenda:3.9.1
-
cpe:2.3:a:joomlic:icagenda:3.9.10
-
cpe:2.3:a:joomlic:icagenda:3.9.11
-
cpe:2.3:a:joomlic:icagenda:3.9.12
-
cpe:2.3:a:joomlic:icagenda:3.9.13
-
cpe:2.3:a:joomlic:icagenda:3.9.14
-
cpe:2.3:a:joomlic:icagenda:3.9.2
-
cpe:2.3:a:joomlic:icagenda:3.9.3
-
cpe:2.3:a:joomlic:icagenda:3.9.4
-
cpe:2.3:a:joomlic:icagenda:3.9.5
-
cpe:2.3:a:joomlic:icagenda:3.9.6
-
cpe:2.3:a:joomlic:icagenda:3.9.7
-
cpe:2.3:a:joomlic:icagenda:3.9.8
-
cpe:2.3:a:joomlic:icagenda:3.9.9
-
cpe:2.3:a:joomlic:icagenda:4.0.0
-
cpe:2.3:a:joomlic:icagenda:4.0.1
-
cpe:2.3:a:joomlic:icagenda:4.0.2
-
cpe:2.3:a:joomlic:icagenda:4.0.3
-
cpe:2.3:a:joomlic:icagenda:4.0.4
-
cpe:2.3:a:joomlic:icagenda:4.0.5
-
cpe:2.3:a:joomlic:icagenda:4.0.6
-
cpe:2.3:a:joomlic:icagenda:4.0.7