Public mode

No access to your tenant or devices. Every item links to its source. What this means

CVE-2026-88857

OrdaSoft Joomla Gallery free extension for Joomla · remote code execution

CVSS 4.0 9.4 CRITICALCheck source for fixed versionsKEV status unknown

Original advisory

cve-program · CVE-2026-88857

Published

Joomla Extension - OrdaSoft.com - Authenticated, Privileged Remote Code Execution in OrdaSoft Joomla Gallery extension for Joomla < 6.2.7 - The extensions saveWatermark() copied an uploaded file into a web-accessible directory using the client-supplied filename exactly as sent, with no extension check, no content check, and no filename sanitisation of any kind. An authenticated core.manage user could upload a .php file disguised with an image Content-Type header and execute it directly by requesting the resulting path.

Read the publisher's advisory

Affected versions, risk and source history

cve-program · CVE-2026-88857

Published

com_osgallery_light

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "com_osgallery_light",
                    "product": "OrdaSoft Joomla Gallery free extension for Joomla",
                    "vendor": "OrdaSoft.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-6.2.6"
                        }
                    ]
                }

com_osgallery

Vendor product

Publisher's version information

Shown as published. These rules are not interpreted as NuGet package version ranges.

{
                    "defaultStatus": "unaffected",
                    "packageName": "com_osgallery",
                    "product": "OrdaSoft Joomla Gallery extension for Joomla",
                    "vendor": "OrdaSoft.com",
                    "versions": [
                        {
                            "status": "affected",
                            "version": "1.0.0-6.2.6"
                        }
                    ]
                }

Original source record · Cite this exact observation · Complete original publisher JSON