CVE-2024-40744: Convert Forms Project Convert Forms

Critical severity, CVSS 9.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Unrestricted file upload via security bypass in Convert Forms component for Joomla in versions before 4.4.8.

Affected products

• Convert Forms Project Convert Forms: from 1.0.0, before 4.4.8 (fixed in 4.4.8)

Published 2024-12-04. Last modified 2026-06-17.