CVE-2026-57828: Phoca Download

High severity, CVSS 8.8. EPSS: 0.5% chance of exploitation in the next 30 days.

Joomla Extension - phoca.cz - Authenticated file upload in Phoca Downloads component < 6.1.3 - The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload that allows registered users uploading executable files and leads to full RCE.

Affected products

• Phoca Download: before 6.1.3 (fixed in 6.1.3)

Published 2026-07-11. Last modified 2026-08-19.