CVE-2026-100747

Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name.

Score

CVSS 3.1 6.5 Medium

Status

Analyzed - security@joomla.org

Published

2026-09-27

Last modified

2026-10-20

Weaknesses

CWE-352

Affected products

• Event Gallery (Svenbluege)
• Event Gallery For Joomla (Svenbluege.de)

References

• https://www.svenbluege.de/