iCagenda Unrestricted File Upload Exploitation (CVE-2026-48939)

let SuspiciousExt = dynamic([".php",".php5",".phtml",".phar",".pht",".asp",".aspx",".jsp"]);
W3CIISLog
| where csUriStem has_any ("/components/com_icagenda/", "/media/com_icagenda/", "icagenda")
| where csMethod == "POST"
| where csUriStem has_any ("upload", "attachment", "image")
| extend FileExt = tostring(extract(@"(\.[A-Za-z0-9]+)$", 1, csUriStem))
| where FileExt in (SuspiciousExt) or scStatus == 200
| project TimeGenerated, cIP, csMethod, csUriStem, csUserAgent, scStatus
| order by TimeGenerated desc

index=web_logs (uri="*com_icagenda*" OR uri="*icagenda*") method=POST (uri="*upload*" OR uri="*attachment*" OR uri="*image*")
| rex field=uri "(?<file_ext>\.[A-Za-z0-9]+)$"
| eval suspicious=if(match(file_ext, "(?i)\.(php\d?|phtml|phar|pht|asp|aspx|jsp)$"), 1, 0)
| where suspicious=1 OR status=200
| stats count by src_ip, uri, status, http_user_agent, _time
| sort -_time

any where event.dataset == "nginx.access" and
  url.path : ("*com_icagenda*", "*icagenda*") and
  http.request.method == "POST" and
  url.path : ("*upload*", "*attachment*", "*image*") and
  (url.path : ("*.php", "*.php5", "*.phtml", "*.phar", "*.pht", "*.asp", "*.aspx", "*.jsp") or http.response.status_code == 200)

SELECT sourceip, "URL", httpmethod, httpstatuscode, useragent, devicetime
FROM events
WHERE "URL" ILIKE '%com_icagenda%'
AND httpmethod = 'POST'
AND ("URL" ILIKE '%upload%' OR "URL" ILIKE '%attachment%' OR "URL" ILIKE '%image%')
AND ("URL" ILIKE '%.php%' OR "URL" ILIKE '%.phtml%' OR "URL" ILIKE '%.phar%' OR "URL" ILIKE '%.asp%' OR "URL" ILIKE '%.jsp%' OR httpstatuscode = 200)
LAST 24 HOURS

_sourceCategory=web/access
| where uri matches "*com_icagenda*" or uri matches "*icagenda*"
| where method="POST"
| where uri matches "*upload*" or uri matches "*attachment*" or uri matches "*image*"
| parse regex field=uri "(?<file_ext>\.[A-Za-z0-9]+)$"
| where file_ext matches "*php*" or file_ext matches "*phtml*" or file_ext matches "*phar*" or file_ext matches "*asp*" or file_ext matches "*jsp*" or status_code=200
| count by src_ip, uri, status_code, user_agent

rule icagenda_cve_2026_48939_upload {
  meta:
    author = "detection-platform"
    description = "Detects suspicious file upload to iCagenda Joomla component consistent with CVE-2026-48939"
    severity = "HIGH"
  events:
    $e.metadata.event_type = "NETWORK_HTTP"
    $e.network.http.method = "POST"
    $e.target.url = /.*com_icagenda.*/ nocase
    $e.target.url = /.*(upload|attachment|image).*/ nocase
    $e.target.url = /.*\.(php\d?|phtml|phar|pht|asp|aspx|jsp)$/ nocase
  match:
    $e over 5m
  condition:
    $e
}

#event_simpleName=HttpRequest
| WebPath="*com_icagenda*" OR WebPath="*icagenda*"
| HttpMethod="POST"
| WebPath="*upload*" OR WebPath="*attachment*" OR WebPath="*image*"
| WebPath=/\.(php\d?|phtml|phar|pht|asp|aspx|jsp)$/i OR HttpStatusCode=200
| table([ClientIP, WebPath, HttpMethod, HttpStatusCode, UserAgent, ContainerName, timestamp])