Security
JoomGallery fixes unauthenticated file-upload flaw
JoomGallery 4.0.0 through 4.4.1 contains an unauthenticated file-upload vulnerability that is fixed in version 4.4.2.
Research published by mySites.guru identifies the issue in JoomGallery, the Joomla extension from joomgalleryfriends.net. Tracked as CVE-2026-84048, the flaw allows an anonymous visitor to write files to the site’s temporary directory and read or delete another user’s upload. The advisory rates it 6.3 Medium under CVSS 4.0, while the vendor describes the issue as critical.
The affected range is 4.0.0 through 4.4.1; 4.4.2 contains the fix. The report says the files do not receive attacker-controlled names or extensions, limiting the likelihood of direct code execution on a standard server. It reports no known exploitation in the wild.
- Upgrade every affected installation to
4.4.2. - Administrators who acted on the CVE’s earlier, incorrect fix reference should verify that the installed version is
4.4.2, not4.4.1.
mySites.guru says the CVE record originally named the wrong release as the fix, but the record has since been corrected.
Originally reported by mySites.guru.