Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-115451— Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6

Quick assessment

Affected
tassos.gr Advanced Custom Fields extension for Joomla
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Joomla 扩展程序漏洞（tassos.gr）：Advanced Custom Fields 扩展（版本 2.8.13–2.8.15、3.1.4–3.1.8）以及 Smile Pack 扩展（版本 1.2.7–1.2.9、2.1.2–2.1.6）存在因访问控制不当导致的文件删除漏洞。该漏洞允许任何人在未登录的情况下删除画廊（Gallery）文件夹中的图片，包括已发布文章和模块中的图片。此外，在 Advanced Custom Fields 3.1.7 和 3.1.8 版本中，用户还能查看、删除或保存其他用户未保存

CVSS 6.9 · Medium

Possible ATT&CK Techniques 1 AI

T1565.001 · Stored Data Manipulation

Affected Version Matrix 4

VendorProduct Version RangeStatus
tassos.gr Advanced Custom Fields extension for Joomla 3.1.4-3.1.8 affected
2.8.13-2.8.15 affected
tassos.gr Smile Pack extension for Joomla 2.1.2-2.1.6 affected
1.2.7-1.2.9 affected
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-115451

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6
Source: CVE Program / CVE List V5
Vulnerability Description
Joomla Extension - tassos.gr - File deletion through improper access control in Advanced Custom Fields extension 2.8.13-2.8.15, 3.1.4-3.1.8 and Smile Pack 1.2.7-1.2.9, 2.1.2-2.1.6 - Anyone could delete images in the Gallery folders, including images on published articles and modules, without logging in. In ACF 3.1.7 and 3.1.8, users could also see, remove or save each other’s unsaved uploads.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
访问控制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
tassos.gr Advanced Custom Fields extension for Joomla 3.1.4-3.1.8 -
tassos.gr Smile Pack extension for Joomla 2.1.2-2.1.6 -

II. Public POCs for CVE-2026-115451

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-115451

请登录查看更多情报信息。

Other References for CVE-2026-115451 (1)

IV. Related Vulnerabilities

Same product: Advanced Custom Fields extension for Joomla
Same vendor: tassos.gr
Same weakness: CWE-284