Security
Gantry 5 fixes high-severity Joomla file upload flaw
Gantry 5.6.7 addresses a high-severity Joomla file upload vulnerability, while sites running Joomla 3 or 4 remain without a fixed Gantry release.
mySites.guru reported that Gantry 5 allowed an authenticated Joomla user with only Modules manager permissions to upload arbitrary file types through its administrator file picker, including PHP files. The issue is rated High, with a CVSS 4.0 score of 8.6. No CVE identifier has been assigned.
The vulnerability affects Gantry 5 releases before 5.6.6. That version introduced the security changes, but administrators should install 5.6.7, which also corrects a fatal error found in 5.6.6. The update limits file types and applies additional permission and path checks. The vendor has not said the flaw was exploited, and mySites.guru said it has not observed exploitation.
- Joomla 5 and 6 administrators should back up their sites and install
Gantry 5.6.7, using the package from Gantry or GitHub if Joomla’s update screen does not yet offer it. - Joomla 3 and 4 have no fixed Gantry release. Their last versions,
5.5.19and5.5.25, remain affected. Restrict Modules manager access, check for suspicious files and accounts, and plan migration to Joomla 5.
Originally reported by mySites.guru.