CVE-2026-48939

This bug is in a Joomla add-on (iCagenda) that handles file uploads. If someone finds an unpatched site, they can trick the extension into uploading a malicious PHP file and then run it on your server. Think of it like an online storefront letting a stranger upload a “program” through a package drop—once it’s there, it can run.

This matters if you run Joomla and have the iCagenda extension installed, especially versions before 4.0.8 or 3.9.15. Because the flaw does not require authentication and attackers can exploit it over the network, exposed sites are at real risk. It’s a risk when the vulnerable iCagenda extension is installed and reachable through normal website use (notably the file attachment/upload feature).

This is RED because attackers are already exploiting it in the wild, and it’s listed in CISA’s KEV catalog. CISA set a remediation deadline of 2026-07-13, so you should treat this as an urgent patch/mitigation today. Even if you haven’t seen an incident yet, active exploitation means you should assume a window of exposure now.