CVE-2026-84048: Joomgalleryfriends.net Joomgallery Extension For Joomla

Medium severity, CVSS 6.3. EPSS: 0.5% chance of exploitation in the next 30 days.

Joomla Extension - joomgalleryfriends.net - Unauthenticated arbitrary file upload via the TUS endpoint in JoomGallery < 4.4.2 - The TUS endpoint allows arbitrary file uploads, however neither file name nor file extension are under attacker control. Code execution requires non-standard server configuration.

Affected products

• Joomgalleryfriends.net Joomgallery Extension For Joomla: version 4.0.0-4.4.1 only

Published 2026-09-15. Last modified 2026-09-19.