A vulnerability in the iCagenda extension for Joomla

CVE-2026-48939 is an unauthenticated arbitrary file upload in the iCagenda Joomla extension's frontend event-registration form. The controller layer skips file-type checks (access control is only enforced at the view layer — CWE-284/CWE-434), and uploads land directly under /images/icagenda/frontend/attachments/ inside the web root, where PHP is executable. Any anonymous internet visitor can POST a .php webshell and immediately fetch it via GET. Affected: iCagenda 1.0.0 through 4.0.7; fixed in 4.0.8 (mainline, 2026-06-15) and 3.9.15 (legacy branch, 2026-06-16).

The vendor CVSS of 9.8 (some feeds list 10.0) is accurate — this is a textbook pre-auth RCE on a component whose entire purpose is to be internet-facing. Add active exploitation since June 15, 2026 and CISA KEV inclusion with a remediation due date of July 13, 2026 (yesterday), and there is no plausible reading that softens this. If iCagenda is installed on a public Joomla site, assume compromise until proven otherwise.

Why this verdict

• KEV-listed with due date already passed (2026-07-13) — CISA has independently validated exploitation; federal agencies are already out of SLA.
• Zero prerequisites: AV:N/AC:L/PR:N/UI:N. The attacker needs an HTTP client and the target URL. No credentials, no phishing, no internal foothold.
• Public weaponized exploit on GitHub plus Nuclei template — commoditized, script-kiddie tier.
• Role multiplier: iCagenda by design runs on public Joomla sites. Every install occupies the internet-facing role — there is no low-value deployment tier. Blast radius is host RCE → DB credential theft (Joomla configuration.php) → tenant/shared-host pivot.
• Friction audit fails to reduce severity: no friction point narrows the population. WAFs help but are not universal; Joomla small-shop deployments rarely front-end with ModSecurity.

Why not higher?

CRITICAL is the ceiling in this schema. Impact is capped at webserver-user RCE — it is not kernel, not identity provider, not hypervisor. A single compromised Joomla site is unlikely to cascade to enterprise-fleet takeover unless the site shares infrastructure with more sensitive tiers.

Why not lower?

Every downgrade lever fails: exploitation is active and confirmed (not theoretical), the exploit is public (not researcher-only), there are no auth prerequisites (not post-auth), and the affected component is definitionally internet-facing (not internal-only). Downgrading below HIGH would require ignoring KEV and ITW evidence.

1. Take iCagenda offline immediately if you cannot patch today — Unpublish or uninstall the com_icagenda component via Joomla Extensions Manager. This is the noisgate CRITICAL mitigation SLA of ≤3 days — for KEV+ITW the effective window is hours. If the extension is business-critical, block frontend event submission via .htaccess deny on the submit route until patched.
2. Deny PHP execution in the uploads directory — Add an Nginx location ~ /images/icagenda/.*\.php$ { deny all; } or Apache <FilesMatch "\.ph(p[3457]?|t|tml|ar)$">Require all denied</FilesMatch> block scoped to /images/icagenda/frontend/attachments/. Deploy within hours, well inside the ≤3-day mitigation SLA.
3. Hunt for existing webshells — Search /images/icagenda/frontend/attachments/ recursively for .php, .phtml, .phar, and any file with PHP shebang or <?php content. Grep webserver access logs from 2026-06-01 onward for POSTs to iCagenda submission endpoints followed by GETs of new files in that directory. Assume-breach if the extension was exposed.
4. Rotate Joomla DB credentials and admin passwords — If exposure existed prior to patching, treat configuration.php as leaked. Rotate DB user password, Joomla super-user passwords, any API tokens embedded in the config, and revoke sessions.
5. Deploy WAF virtual patch — Cloudflare, Sucuri, and Wordfence have published rules blocking multipart uploads containing PHP magic bytes to iCagenda endpoints. Enable within hours as a stopgap while planning the version upgrade.

Run this on the Joomla webserver host as the user owning the Joomla install (or root). Invoke as ./check_icagenda.sh /var/www/html. It reads the iCagenda manifest, compares version to the patched baselines, and inspects the attachments directory for suspicious PHP artifacts.

#!/usr/bin/env bash
# noisgate verifier — CVE-2026-48939 (iCagenda Joomla RCE)
# Usage: ./check_icagenda.sh <joomla_webroot>
# Exits 0 PATCHED, 1 VULNERABLE, 2 UNKNOWN
set -u
ROOT="${1:-/var/www/html}"
MANIFEST="$ROOT/administrator/components/com_icagenda/icagenda.xml"
ATTACH_DIR="$ROOT/images/icagenda/frontend/attachments"

if [ ! -f "$MANIFEST" ]; then
  echo "UNKNOWN: iCagenda manifest not found at $MANIFEST"
  exit 2
fi

VER=$(grep -oE '<version>[^<]+' "$MANIFEST" | head -n1 | sed 's/<version>//')
if [ -z "$VER" ]; then
  echo "UNKNOWN: could not parse version"
  exit 2
fi
echo "Installed iCagenda version: $VER"

# semver-ish compare: patched if >=4.0.8, or >=3.9.15 on 3.x branch
vuln=1
IFS='.' read -r MAJ MIN PAT <<< "$VER"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}
if [ "$MAJ" -gt 4 ]; then vuln=0; fi
if [ "$MAJ" -eq 4 ] && { [ "$MIN" -gt 0 ] || [ "$PAT" -ge 8 ]; }; then vuln=0; fi
if [ "$MAJ" -eq 3 ] && [ "$MIN" -eq 9 ] && [ "$PAT" -ge 15 ]; then vuln=0; fi

# Even patched — hunt for planted shells
SHELLS=0
if [ -d "$ATTACH_DIR" ]; then
  SHELLS=$(find "$ATTACH_DIR" -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.php[3457]' \) 2>/dev/null | wc -l)
  if [ "$SHELLS" -gt 0 ]; then
    echo "WARNING: $SHELLS suspicious PHP-executable file(s) found in $ATTACH_DIR:"
    find "$ATTACH_DIR" -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' \) -printf '  %p (mtime %TY-%Tm-%Td)\n'
  fi
fi

if [ "$vuln" -eq 1 ]; then
  echo "VULNERABLE: iCagenda $VER is affected by CVE-2026-48939. Upgrade to 4.0.8 or 3.9.15."
  exit 1
fi
if [ "$SHELLS" -gt 0 ]; then
  echo "VULNERABLE: iCagenda patched but suspicious artifacts present — assume prior compromise."
  exit 1
fi
echo "PATCHED: iCagenda $VER is not affected and attachments dir is clean."
exit 0

Sources

1. CISA KEV — CVE-2026-48939
2. TheHackerNews — iCagenda and Balbooa Joomla flaws exploited as zero-days
3. BleepingComputer — CISA warns of actively exploited Joomla extension RCE flaws
4. SecurityWeek — Organizations warned of exploited Joomla extension vulnerabilities
5. IONIX threat center — CVE-2026-48939
6. shinthink/CVE-2026-48939 PoC (GitHub)
7. mySites.guru — iCagenda Zero Day File Upload RCE Fixed in 4.0.8
8. SentinelOne vulnerability database — CVE-2026-48939