The Joomla extension Phoca Downloads is vulnerable to an authenticated arbitrary file upload

Phoca Downloads is a file distribution component for Joomla — think document library, driver download page, media asset store. Versions 1.0 through 6.1.2 ship an upload handler that fails to enforce the file-type allowlist for authenticated Joomla users. A logged-in account (any role, including default Registered) can POST an executable file (.php, .phtml, .php7, sometimes hidden via double-extension or content-type games) into the component's storage directory, request it back over HTTP, and execute code as the web server user. Fixed in 6.1.3.

There is no vendor-issued CVSS baseline, only a third-party CVSS 4.0 score of 9.0 (AV:N/AC:L/AT:P/PR:L/UI:N/VC:H/VI:H/VA:H). That number is *directionally right but overstated for the median deployment*. Every reachable Phoca Downloads install ends at RCE, yes — but only after clearing authentication. On Joomla sites with self-registration disabled, the exposed population is only the site's existing user base. HIGH is the honest read; CRITICAL is reserved for pre-auth internet-facing bugs.

Why this verdict

• Authentication requirement caps the pre-auth blast radius — on hardened Joomla sites with registration off, the exposed population collapses to existing account holders, which pulls this off the CRITICAL bucket.
• Self-registration is Joomla's default, and thousands of Phoca-using sites leave it on — that keeps this well above MEDIUM. PR:L in CVSS 4.0 is doing real work here but is not a hard gate.
• Role multiplier — canonical deployment role is a public-facing CMS content server, not an identity/hypervisor/CA. Successful chain ends in webroot RCE and DB compromise for that site, not fleet compromise. No high-value-role floor triggered.
• Fix is available same-day as disclosure (6.1.3), and the extension has a lightweight update path via Joomla's built-in updater — remediation friction is low, which does not reduce severity but constrains the window.

Why not higher?

CRITICAL requires either unauthenticated exploitation, KEV listing, active exploitation, or a high-value-role blast radius (DC, IdP, hypervisor, backup, CA, edge appliance). None apply: this needs a Joomla login, has no observed exploitation, and hits a CMS content tier — not identity or infrastructure. Third-party CVSS 9.0 overweights impact and underweights the auth gate.

Why not lower?

MEDIUM would ignore that Joomla's default configuration allows self-registration, making the auth barrier a speed bump rather than a wall. The outcome is unambiguous full RCE with follow-on DB and secret exposure — that is not a MEDIUM-class impact even when the population is narrow.

1. Disable Joomla self-registration site-wide — Global Configuration → Users → Allow User Registration = No. Collapses the attacker population to your existing user base. Deploy within 30 days per the noisgate mitigation SLA for HIGH; for internet-facing Phoca instances, do it today.
2. Revoke frontend upload permission from Registered and Author groups in Phoca Downloads config — In com_phocadownload component options, set Enable User Upload = No or restrict to Manager+ only. Blocks step 2 of the attack path even for authenticated users. Deploy within 30 days.
3. Deny PHP execution inside Phoca's upload directory at the webserver — Apache: drop .htaccess with <FilesMatch "\.ph(p[0-9]?|tml|ar|ps)$">Require all denied</FilesMatch> in /images/phocadownload/. Nginx: location ~ ^/images/phocadownload/.*\.ph(p[0-9]?|tml|ar|ps)$ { deny all; }. Neuters the payload even if it lands. Deploy within 30 days.
4. WAF rule: block multipart uploads to com_phocadownload upload views with executable extensions — ModSecurity/CRT/Cloudflare rule matching option=com_phocadownload and Content-Disposition: filename= containing \.ph(p|tml|ar). Bridge control until the patch is deployed.
5. Upgrade to Phoca Downloads 6.1.3+ — The actual fix. Use Joomla's Extension Manager → Update. Complete within 180 days per the noisgate remediation SLA for HIGH; realistically do it within the mitigation window if the site is internet-facing.

Run on each Joomla host as any user with read access to the Joomla webroot. Invoke as ./check-phoca.sh /var/www/joomla where the argument is the Joomla installation path. No elevated privileges required beyond read access to administrator/components/com_phocadownload/phocadownload.xml.

#!/usr/bin/env bash
# noisgate check for CVE-2026-57828 — Phoca Downloads authenticated arbitrary file upload
# Usage: ./check-phoca.sh /path/to/joomla
set -u

JROOT="${1:-/var/www/html}"
FIXED_MAJOR=6
FIXED_MINOR=1
FIXED_PATCH=3

MANIFEST="$JROOT/administrator/components/com_phocadownload/phocadownload.xml"
ALT_MANIFEST="$JROOT/components/com_phocadownload/phocadownload.xml"

if [[ ! -f "$MANIFEST" && ! -f "$ALT_MANIFEST" ]]; then
  echo "UNKNOWN: com_phocadownload not installed at $JROOT"
  exit 2
fi

[[ -f "$MANIFEST" ]] || MANIFEST="$ALT_MANIFEST"

VER=$(grep -oE '<version>[^<]+</version>' "$MANIFEST" | head -1 | sed -E 's|</?version>||g')

if [[ -z "$VER" ]]; then
  echo "UNKNOWN: could not parse version from $MANIFEST"
  exit 2
fi

IFS='.' read -r MAJ MIN PAT <<<"$VER"
MAJ=${MAJ:-0}; MIN=${MIN:-0}; PAT=${PAT:-0}

vuln=1
if (( MAJ > FIXED_MAJOR )); then vuln=0
elif (( MAJ == FIXED_MAJOR && MIN > FIXED_MINOR )); then vuln=0
elif (( MAJ == FIXED_MAJOR && MIN == FIXED_MINOR && PAT >= FIXED_PATCH )); then vuln=0
fi

if (( vuln == 1 )); then
  echo "VULNERABLE: Phoca Downloads $VER installed (fixed in 6.1.3)"
  # Bonus: hunt for existing web shells in the upload dir
  UPLOAD_DIR="$JROOT/images/phocadownload"
  if [[ -d "$UPLOAD_DIR" ]]; then
    SUSPECT=$(find "$UPLOAD_DIR" -type f \( -iname '*.php' -o -iname '*.phtml' -o -iname '*.phar' -o -iname '*.php7' -o -iname '*.pht' \) 2>/dev/null)
    if [[ -n "$SUSPECT" ]]; then
      echo "WARNING: executable files already present in upload dir:"
      echo "$SUSPECT"
    fi
  fi
  exit 1
fi

echo "PATCHED: Phoca Downloads $VER (>= 6.1.3)"
exit 0

Sources

1. CVE-2026-57828 record (ThreatINT)
2. NVD entry for CVE-2026-57828
3. MITRE CVE record
4. Phoca Downloads product page
5. Phoca Downloads on Joomla Extension Directory
6. Joomla Vulnerable Extensions List
7. Related Phoca family CVE-2025-54473 (Phoca Commander RCE)
8. CISA KEV catalog