Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88856

OrdaSoft Joomla Gallery free extension for Joomla · remote code execution

CVSS 4.0 9.4 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88856

Published

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions updateOSGallery(), reached via task=update_osgallery, read a JSON request body and called the value of a method field as a live PHP function, passing the value of a package field as its single argument, with no allow-list or is_callable() check of any kind. Any function name compatible with a single argument was directly reachable, including system, exec, shell_exec, and passthru.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88856

Published

com_osgallery_light

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "com_osgallery_light",
                    "product": "OrdaSoft Joomla Gallery free extension for Joomla",
                    "vendor": "OrdaSoft.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-6.2.6"
                        }
                    ]
                }

com_osgallery

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "com_osgallery",
                    "product": "OrdaSoft Joomla Gallery extension for Joomla",
                    "vendor": "OrdaSoft.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-6.2.6"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON