iCagenda Unrestricted Upload of File with Dangerous Type Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 10/07/2026. Patch affected systems as an emergency.
| Package | Affected versions | Patched versions |
|---|---|---|
| icagenda | ≥ 3.2.1, < 3.9.15≥ 4.0.0, < 4.0.8 | 3.9.154.0.8 |
A vulnerability in the iCagenda extension for Joomla allows the upload of arbitrary files in the file attachment feature, ultimately resulting in PHP code upload and execution.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free