jDownloads fixes unauthenticated upload flaw in 4.1.6

Research published by mySites.guru found that the affected Joomla extension included a standalone test upload script outside Joomla’s normal authentication and permission checks. An unauthenticated visitor could use it to place certain files on a site. The issue is tracked as CVE-2026-61900 and classified as CWE-434, unrestricted upload of file with dangerous type.

mySites.guru reproduced the issue but did not report evidence of active exploitation. The script rejected direct PHP uploads, although the advisory says its permitted file types included archives, documents, images and executables. The research rates the vulnerability High because the endpoint was publicly reachable and could be more serious on incorrectly configured servers.

• Affected: jDownloads 4.1.0 through 4.1.5
• Fixed: jDownloads 4.1.6
• Action: update every affected installation to 4.1.6. If an immediate update is not possible, remove administrator/components/com_jdownloads/assets/upload/upload-handler.php as a temporary measure and review the related test_uploads directory for unexpected files.

Originally reported by mySites.guru.