Security
YOOtheme ZOO flaws fixed in version 4.1.64
YOOtheme has fixed three unauthenticated vulnerabilities in its ZOO Joomla extension, including a critical file-upload flaw that can lead to remote code execution.
The issues affect com_zoo versions 1.0.0 through 4.1.63. mySites.guru published the research and reported that the flaws were demonstrated on a live test installation, rather than inferred solely from code.
CVE-2026-74803: arbitrary file upload leading to remote code execution, CVSS 10.0, CWE-434.CVE-2026-74804: unauthenticated SQL injection, CVSS 9.3, CWE-89.CVE-2026-75114: unauthenticated open redirect, CVSS 5.1, CWE-601.
YOOtheme released the fix in ZOO 4.1.64 on 19 August 2026. Administrators should update every installation to that version or later, including sites without a front-end submission form, because the SQL injection does not require one.
Sites running the 3.x branch remain within the affected range, but no 3.x security release is available. Administrators should plan a move to 4.x or remove the extension. After updating, inspect images/zoo/uploads/ and other image directories for unexpected PHP or other non-image files, and investigate any signs of compromise.
Originally reported by mySites.guru.