Trending
CVE-2026-48939

CVE detail

CVE-2026-48939

A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.

CVSS 10.0 · CriticalBuzz score 80.2KEV listed2 public exploit repository references

Buzz score

Why this CVE is surfacing

Buzz score total 80.2

This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.

Buzz score components · mention 24.9 · diversity 20.0 · KEV 25.0 · OTX 0.0 · PoC 10.4

Mention score

24.9

11 evidence mentions in the snapshot

Diversity score

20.0

9 sources across 5 categories

KEV score

25.0

Known exploited vulnerability present

OTX score

0.0

0 OTX pulses

PoC score

10.4

2 repos · best confidence 0.99

Best PoC traction

Maximum stars on a matched PoC repo

Why it matters now

Mention timeline

Total mentions: 5; within the 30d window
Peak daily: 2; highest bucket

Evidence

Source links by recency

Newest mentions first

11 source links · newest first

Baddies caught exploiting extensions bugs with perfect 10 scores on vulnerable Joomla websitesThe Register Security
that can ultimately be executed as PHP code on the server, handing over remote control of the affected site. CISA added CVE-2026-48939, affecting iCagenda, and CVE-2026-56291, affecting Balbooa Forms, to its KEV catalog this week after confirming in-the-wild exploitation. Federal civilian agencies were ordered to patch against the flaws under the agenc
newswww.theregister.comJul 14, 2026, 11:06 AM
Organizations Warned of Exploited Joomla Extension VulnerabilitiesSecurityWeek
la extensions that allow unauthenticated attackers to achieve remote code execution (RCE). The Balbooa flaw, tracked as CVE-2026-56291 (CVSS score of 10), is described as an unauthenticated arbitrary file upload issue affecting the extension’s frontend attachment upload endpoint. Balbooa Forms version 2.4.1 was released on July 9 with patches for the b
newswww.securityweek.comJul 13, 2026, 9:08 AM
iCagenda and Balbooa Forms Joomla Flaws Reportedly Exploited as Zero-DaysThe Hacker News
orts of zero-day exploitation in the wild. The vulnerabilities, both rated 10.0 on the CVSS scoring system, are below - CVE-2026-48939 - A vulnerability in the
newsthehackernews.comJul 13, 2026, 5:36 AM
U.S. CISA adds iCagenda and Balbooa Forms flaws to its Known Exploited Vulnerabilities catalogSecurity Affairs
enda and Balbooa Forms flaws to its Known Exploited Vulnerabilities (KEV) catalog . The flaws added to the catalog are: CVE-2026-48939 (CVSS score of 10.0) iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability iCagenda is an open-source event man
newssecurityaffairs.comJul 11, 2026, 7:31 PM
CISA Adds Two Known Exploited Vulnerabilities to CatalogCISA Alerts
wo new vulnerabilities to its Known Exploited Vulnerabilities (KEV) Catalog , based on evidence of active exploitation. CVE-2026-48939 iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability CVE-2026-56291 Balbooa Forms Unrestricted Upload of File with Dangerous Type Vulnerability These types of vulnerabilities are a frequent attack vect
governmentwww.cisa.govJul 10, 2026, 12:00 PM
https://www.icagenda.com/docs/changelog/icagenda-4-0-8www.icagenda.com
No excerpt available.
Release Noteswww.icagenda.comJun 20, 2026, 1:16 PM
https://www.icagenda.com/docs/changelog/icagenda-3-9-15www.icagenda.com
No excerpt available.
Release Noteswww.icagenda.comJun 20, 2026, 1:16 PM
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-48939www.cisa.gov
No excerpt available.
Mitigationwww.cisa.govJun 20, 2026, 1:16 PM
https://mysites.guru/blog/icagenda-zero-day-file-upload-rce/mysites.guru
No excerpt available.
Exploitmysites.guruJun 20, 2026, 1:16 PM
https://github.com/Polosss/By-Poloss..-..CVE-2026-48939github.com
No excerpt available.
Exploitgithub.comJun 20, 2026, 1:16 PM
https://www.icagenda.com/www.icagenda.com
No excerpt available.
Release Noteswww.icagenda.comJun 20, 2026, 1:16 PM

Exploit code

Public exploit repository references

Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.

2 repository references · best confidence 0.99 · max 2 stars

shinthink/CVE-2026-48939High confidence
githubDiscovery source unavailable2 starsDiscovered Jul 9, 2026, 1:19 AM
Polosss/By-Poloss..-..CVE-2026-48939High confidence
githubNVD Exploit reference0 starsDiscovered Jul 11, 2026, 6:10 AM
NVD labels the source link as Exploit; this is not independent verification of the repository's code.

Related records

Similar CVEs

6 related CVEs with shared weakness or product evidence

CVE-2026-13714
The Realtyna Organic IDX plugin + WPL Real Estate WordPress plugin before 5.3.0 does not validate the type of uploaded files, and its file upload functionality is gated only by an…
CVSS 9.8 · Critical
1 mention
CVE-2026-10818
The WPForms Pro plugin for WordPress is vulnerable to Arbitrary File Upload in all versions up to, and including, 1.10.1.1 via the ajax_chunk_upload_finalize function. This is due…
CVSS 8.1 · High
2 mentions
CVE-2026-24727
An unrestricted upload of file with dangerous type vulnerability in the e-paper draft upload function of SUNNET Corporate Training Management System through v10.3 allows remote au…
CVSS 9.3 · Critical
1 mention
CVE-2026-65461
Administrator Arbitrary File Upload in Really Simple CSV Importer <= 1.3 versions.
CVSS 9.1 · Critical
1 mention
CVE-2026-65455
Administrator Arbitrary File Upload in MapSVG <= 8.14.0 versions.
CVSS 9.1 · Critical
1 mention
CVE-2026-27064
Editor Arbitrary File Upload in Mailster <= 4.1.17 versions.
CVSS 9.1 · Critical
1 mention

External lookup

Potential internet exposure

Potential exposure only — not proof of vulnerability.Shodan results indicate potentially internet-exposed products, not confirmed vulnerable systems. They do not confirm that any returned system is vulnerable to CVE-2026-48939.

Product-level CPE searches intentionally omit version fields and NVD version-range or configuration certainty. Verify the exact product version and configuration independently.

Sign-in required. Shodan requires you to sign in to run these filter searches.

Product CPE queries

Derived from this CVE's existing NVD CPE 2.3 records; the application, operating-system, or hardware part is retained.

cpe:2.3:a:joomlic:icagendaSearch this product on Shodan

Exact CVE query

Eligible paid Shodan plan required

Shodan's exact vuln: filter is separate from the product searches above and requires an eligible paid Shodan plan.

vuln:CVE-2026-48939Search this CVE on Shodan

These are outbound search links only. cvebuzz makes no Shodan API call, uses no Shodan API key, and does not display live result counts.

Metadata

Canonical fields

NVD status

Analyzed

Published

Jun 20, 2026

Modified

Jul 11, 2026

Official record

Authoritative NVD record

CVSS vector

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:Y/R:X/V:X/RE:X/U:Red

CWE IDs

Vendor classifications

How this vector reads

CVSS 4.0 base metrics decoded below. This explanation does not recalculate or change the NVD score.

Attack Vector (AV): Network. The vulnerable system can be reached across network boundaries.
Attack Complexity (AC): Low. No special conditions beyond the attacker-controlled steps are required.
Attack Requirements (AT): None. No prerequisite deployment or execution condition is required.
Privileges Required (PR): None. The attacker needs no privileges on the vulnerable system.
User Interaction (UI): None. Exploitation does not require a targeted user to act.
Vulnerable System Confidentiality (VC): High. There is a total or serious impact to this security property.
Vulnerable System Integrity (VI): High. There is a total or serious impact to this security property.
Vulnerable System Availability (VA): High. There is a total or serious impact to this security property.
Subsequent System Confidentiality (SC): High. There is a total or serious impact to this security property.
Subsequent System Integrity (SI): High. There is a total or serious impact to this security property.
Subsequent System Availability (SA): High. There is a total or serious impact to this security property.

Optional CVSS v4 metrics remain in the raw vector; only base metrics are expanded here.

Signals

Exploitation indicators

1 stored signals · KEV present · 0 OTX pulses

KEVKEV
- cwes: CWE-434
- dueDate: 2026-07-13
- knownRansomwareCampaignUse: Unknown
- notes: https://www.icagenda.com/#download ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-48939
- product: iCagenda
- requiredAction: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- shortDescription: iCagenda contains an unrestricted upload of file with dangerous type vulnerability that allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
- vendorProject: iCagenda
- vulnerabilityName: iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability
Observed Jul 10, 2026, 12:00 AM