Vulnerability Details CVE-2026-48939
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.825
EPSS Ranking 99.6%
CVSS Severity
CVSS v3 Score 9.8
Proposed Action
iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Ransomware Campaign
Unknown
References
- https://www.icagenda.com/
- https://github.com/Polosss/By-Poloss..-..CVE-2026-48939
- https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939
- https://www.icagenda.com/docs/changelog/icagenda-3-9-15
- https://www.icagenda.com/docs/changelog/icagenda-4-0-8
Products affected by CVE-2026-48939
-
cpe:2.3:a:joomlic:icagenda:3.2.1
-
cpe:2.3:a:joomlic:icagenda:3.8.0
-
cpe:2.3:a:joomlic:icagenda:3.8.1
-
cpe:2.3:a:joomlic:icagenda:3.8.10
-
cpe:2.3:a:joomlic:icagenda:3.8.11
-
cpe:2.3:a:joomlic:icagenda:3.8.13
-
cpe:2.3:a:joomlic:icagenda:3.8.14
-
cpe:2.3:a:joomlic:icagenda:3.8.15
-
cpe:2.3:a:joomlic:icagenda:3.8.16
-
cpe:2.3:a:joomlic:icagenda:3.8.17
-
cpe:2.3:a:joomlic:icagenda:3.8.18
-
cpe:2.3:a:joomlic:icagenda:3.8.19
-
cpe:2.3:a:joomlic:icagenda:3.8.2
-
cpe:2.3:a:joomlic:icagenda:3.8.20
-
cpe:2.3:a:joomlic:icagenda:3.8.21
-
cpe:2.3:a:joomlic:icagenda:3.8.22
-
cpe:2.3:a:joomlic:icagenda:3.8.23
-
cpe:2.3:a:joomlic:icagenda:3.8.24
-
cpe:2.3:a:joomlic:icagenda:3.8.3
-
cpe:2.3:a:joomlic:icagenda:3.8.4
-
cpe:2.3:a:joomlic:icagenda:3.8.5
-
cpe:2.3:a:joomlic:icagenda:3.8.6
-
cpe:2.3:a:joomlic:icagenda:3.8.7
-
cpe:2.3:a:joomlic:icagenda:3.8.8
-
cpe:2.3:a:joomlic:icagenda:3.8.9
-
cpe:2.3:a:joomlic:icagenda:3.9.0
-
cpe:2.3:a:joomlic:icagenda:3.9.1
-
cpe:2.3:a:joomlic:icagenda:3.9.10
-
cpe:2.3:a:joomlic:icagenda:3.9.11
-
cpe:2.3:a:joomlic:icagenda:3.9.12
-
cpe:2.3:a:joomlic:icagenda:3.9.13
-
cpe:2.3:a:joomlic:icagenda:3.9.14
-
cpe:2.3:a:joomlic:icagenda:3.9.2
-
cpe:2.3:a:joomlic:icagenda:3.9.3
-
cpe:2.3:a:joomlic:icagenda:3.9.4
-
cpe:2.3:a:joomlic:icagenda:3.9.5
-
cpe:2.3:a:joomlic:icagenda:3.9.6
-
cpe:2.3:a:joomlic:icagenda:3.9.7
-
cpe:2.3:a:joomlic:icagenda:3.9.8
-
cpe:2.3:a:joomlic:icagenda:3.9.9
-
cpe:2.3:a:joomlic:icagenda:4.0.0
-
cpe:2.3:a:joomlic:icagenda:4.0.1
-
cpe:2.3:a:joomlic:icagenda:4.0.2
-
cpe:2.3:a:joomlic:icagenda:4.0.3
-
cpe:2.3:a:joomlic:icagenda:4.0.4
-
cpe:2.3:a:joomlic:icagenda:4.0.5
-
cpe:2.3:a:joomlic:icagenda:4.0.6
-
cpe:2.3:a:joomlic:icagenda:4.0.7