Joomla iCagenda Extension Arbitrary File Upload and Remote Code Execution Vulnerability (CVE-2026-48939)

1. Apply Official Security Patches

Update the iCagenda extension to the latest secure release immediately.

• For iCagenda 3.9.x: Upgrade to version 3.9.15 or higher
• For iCagenda 4.0.x: Upgrade to version 4.0.8 or higher

2. Temporary Mitigation (If patching cannot be applied immediately)

A. Disable PHP Execution in Upload Directories

Prevent the web server from executing PHP scripts within the iCagenda upload directories (e.g., /images/icagenda/ or /media/com_icagenda/).

Apache (.htaccess) Configuration:

<Directory "/var/www/html/images/icagenda">
    <FilesMatch "\.(php|php3|php4|php5|phtml|pl|py|jsp|asp|sh|cgi)$">
        ForceType text/plain
        Require all denied
    </FilesMatch>
</Directory>

Nginx Configuration:

location ~* ^/images/icagenda/.*\.(php|phtml)$ {
    deny all;
    access_log off;
    log_not_found off;
}

B. Web Application Firewall (WAF) Rules

Deploy WAF rules to block multipart/form-data requests targeting iCagenda upload endpoints that contain executable extensions such as .php, .phtml, or .php5.

A critical vulnerability (CVSS 9.8) exists in the file attachment feature of the iCagenda extension for Joomla. Due to insufficient validation of uploaded file extensions and MIME types (CWE-434), an unauthenticated attacker can upload arbitrary executable files, such as PHP web shells, to the server.

Once uploaded to a web-accessible directory, the attacker can trigger execution by directly requesting the file URL, achieving arbitrary code execution under the privileges of the web server process. This vulnerability is actively exploited in the wild (listed in CISA KEV with an EPSS score of 0.94), making immediate remediation imperative.