CVE-2026-61900

Joomla Extension - dj-extensions.com - Unauthenticated arbitrary file upload in DJ-jDownloads < 4.1.6 - The Joomla extension JDownloads is vulnerable to an unauthenticated file upload, leading to full RCE.

Score

CVSS 4.0 10.0 Critical

Status

Deferred - security@joomla.org

Published

2026-07-20

Last modified

2026-10-24

Weaknesses

CWE-434

Affected products

• Jdownloads Extension For Joomla (Dj-extensions.com)

References

• https://www.jdownloads.com/
• https://mysites.guru/blog/jdownloads-4-1-unauthenticated-upload-flaw/