Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-102785— Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52

Quick assessment

Affected
yootheme.com YOOtheme Pro extension for Joomla
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joomla 扩展 - yootheme.com - YOOtheme Pro 5.0.0 至 5.0.52 存在未认证的远程代码执行漏洞。YOOtheme Pro 中公开可访问的图像转换处理程序未能将规范化后的图像操作及其输出目标与其请求签名进行完整绑定。未认证的远程攻击者可复用合法公开图像 URL 中泄露的签名，注入额外的图像操作，跳出预期的缓存目录，并将攻击者控制的 PNG/PHP 多态文件写入可执行的公共媒体目录。

CVSS 10.0 · Critical

Affected Version Matrix 1

VendorProduct Version RangeStatus
yootheme.com YOOtheme Pro extension for Joomla 5.0.0-5.0.52 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-102785

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y
Source: CVE Program / CVE List V5
Vulnerability Type
危险类型文件的不加限制上传
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
yootheme.com YOOtheme Pro extension for Joomla 5.0.0-5.0.52 -

II. Public POCs for CVE-2026-102785

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-102785

请登录查看更多情报信息。

Vendor Pages for CVE-2026-102785 (1)

IV. Related Vulnerabilities

Same product: YOOtheme Pro extension for Joomla
Same vendor: yootheme.com
Same weakness: CWE-434

V. Comments for CVE-2026-102785

No comments yet

Leave a comment