Vulnerability Details CVE-2026-94131
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.
Exploit prediction scoring system (EPSS) score
EPSS Score 0.003
EPSS Ranking 16.9%
CVSS Severity
CVSS v3 Score 8.1
References
Products affected by CVE-2026-94131
-
cpe:2.3:a:acymailing:acymailing:6.7.0
-
cpe:2.3:a:acymailing:acymailing:8.7.0