Security
Critical Custom Tables upload flaw fixed in version 3.7.8
JoomlaBoat has fixed a critical unauthenticated file-upload vulnerability in its Custom Tables extension for Joomla, affecting versions 1.0 through 3.7.7.
Research published by mySites.guru identifies the issue as CVE-2026-105606, with a CVSS 4.0 score of 9.5 (Critical). It is classified as CWE-434, unrestricted upload of a file with a dangerous type. The flaw is in Custom Tables, not Joomla itself.
A site is exposed when it uses a public Custom Tables submission form containing a file field. An unauthenticated visitor can upload a file with a chosen extension to Joomla’s temporary directory. Depending on the site configuration, that directory may be web-accessible, allowing attacker-controlled content to be hosted under the site’s domain.
The vulnerability requires no account or login, but it does require an exposed public form with a file field. As of 2 November 2026, CVE-2026-105606 was not listed in CISA’s Known Exploited Vulnerabilities catalog.
- Update the complete Custom Tables package to
3.7.8. - If immediate updating is not possible, unpublish or restrict affected public forms.
- Inspect Joomla’s configured temporary folder for unexpected files, particularly scripts, HTML, and configuration files.
Originally reported by mySites.guru.