Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
10.0

YOOtheme Pro for Joomla lets attacker run code

CVE-2026-102785 · published 13 days ago
Summary

The YOOtheme Pro extension for Joomla lets anyone craft a special image link that can place malicious files on your site. This could let a hacker add and run their own code, potentially compromising the website. Update the extension to the latest version or remove the vulnerable component until you can apply a fix.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
yootheme.com yootheme pro extension for joomla 5.0.0-5.0.52
Original advisory text
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
References
Fix within
Internet-facing 3 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically
  • Gives an attacker full control
Severity
10.0 Critical
Exploitation
<1% chance of attack within 30 days
Type
CWE-434Unrestricted File Upload
Timeline
Published22 Oct 2026
Updated30 Oct 2026
First seen22 Oct 2026
Sources
CVE-2026-102785 · NVD
CVE-2026-102785 · MITRE
Track software like this
Free during beta