CVE-2026-48906

The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.

Score

CVSS 4.0 9.3 Critical

Status

Analyzed - security@joomla.org

Published

2026-05-27

Last modified

2026-10-14

Weaknesses

CWE-284

Affected products

• Advanced Custom Fields (Tassos)
• Convert Forms (Tassos)
• Engagebox (Tassos)
• Google Structured Data (Tassos)
• Mailchimp Auto-subscribe (Tassos)
• Smile Pack (Tassos)
• Tassos Code Snippets (Tassos)
• Tassos Framework (Tassos)
• Advanced Custom Fields (Tassos.gr)
• Convert Forms (Tassos.gr)
• Engagebox (Tassos.gr)
• Google Structured Data (Tassos.gr)
• Mailchimp Auto-subscribe (Tassos.gr)
• Novaraintassos Framework Plg System Nrframework (Tassos.gr)
• Smile Pack (Tassos.gr)
• Tassos Code Snippets (Tassos.gr)

References

• https://tassos.gr