Security
Phoca Download fixes authenticated upload RCE
Phoca Download for Joomla contained an authenticated remote code execution flaw in versions up to 6.1.2, allowing eligible members to upload and run PHP files. Version 6.1.3 fixes the issue.
mySites.guru published the research, which was reported to Phoca and fixed in the component’s 6.1.3 release. The vulnerability affects com_phocadownload when its frontend member-upload feature is enabled and a category permits registered users to upload files.
The upload path failed to apply the configured file-type allow-list. As a result, a logged-in member could upload an executable file, such as a PHP script, to the public user-upload directory. The issue is tracked as CVE-2026-57828 and classified as CWE-434 unrestricted upload of file with dangerous type.
- Severity: Critical, CVSS 4.0 score 9.0, according to the Joomla CNA.
- Access requires a registered account and the non-default upload feature to be enabled.
- No proof of concept has been made public.
Administrators should update every installation of Phoca Download from version 6.1.2 or earlier to 6.1.3 or later. Sites that had member uploads enabled should also review the user-upload directory and administrator accounts for signs of tampering.
Originally reported by mySites.guru.