Required actionApply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
KEV: iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
NVD: A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Hunt access logs for unauthenticated POSTs to com_icagenda task=registration.submit followed by PHP execution under /images/icagenda/frontend/attachments/; stock logs miss multipart fields so also monitor for new .php files in that dir.
PreconditionsNetwork access to a Joomla site with iCagenda installed (versions 3.2.1-3.9.14 or 4.0.0-4.0.7); the public event registration form must be enabled (guest-accessible); no authentication required. The file attachment feature is reachable by unauthenticated POST to index.php?option=com_icagenda&task=registration.submit. agent
DeliveryUnauthenticated POST multipart/form-data to index.php?option=com_icagenda&task=registration.submit with jform[attachment] containing a PHP webshell; the file is saved with its original extension to /images/icagenda/frontend/attachments/ and executed via direct HTTP GET.
Exploit notesCVSS attack complexity: LOW | CRITICAL severity (CVSS >= 9.0) | Access controls enforced only at the view layer, not the controller; no extension allowlist, MIME check, or content validation on upload. Automated mass-scanner PoC available (25+ threads).
SummaryiCagenda is a Joomla events/calendar extension whose public 'Submit an Event' form includes a file attachment feature. The registration.submit controller processes uploads without enforcing the configured 'Registered Only' restriction and without validating file extensions or MIME types. Uploaded PHP files land under the web-accessible /images/icagenda/frontend/attachments/ directory and execute immediately. Patched in iCagenda 4.0.8 (Joomla 4/6) and 3.9.15 (Joomla 3).
Tia coverage
First reported2026-07-12
First exploit report2026-07-13
Exploit report → KEV3 days after the listing
When Tia's reporting first covered this CVE and whether a report claimed exploitation before the KEV listing. Lead-time deltas are measured from the exploitation report only — plain coverage is not exploitation intel. See the story links under Mentioned in for coverage detail.