CVE-2026-48939: iCagenda Unrestricted File Upload Leads to RCE in Joomla (KEV, Active Exploitation)

What's Happening

CVE-2026-48939 is an Unrestricted Upload of File with Dangerous Type vulnerability (CWE-434) in the iCagenda component for Joomla. The flaw stems from insufficient file-type validation in iCagenda's upload handlers — specifically the event image/attachment upload endpoints. Because the component fails to properly restrict what file types can be uploaded, an attacker can submit a web shell or other executable content disguised as a legitimate attachment. Once placed on the server, the malicious file can be invoked directly, giving the attacker remote code execution (RCE) on the underlying web server.

Affected Software

• Vendor: iCagenda
• Product: iCagenda (Joomla component)

No specific affected version range or patch date has been published at this time.

Exploitation Status

CVE-2026-48939 is listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, confirming active exploitation in the wild and triggering mandated remediation timelines under BOD 26-04. Defenders running iCagenda should treat this as an immediate, real-world threat rather than a theoretical one — attackers are already using this upload path to gain footholds on Joomla-based sites.

How We Detect It

Our detection targets the exploitation pattern rather than a single payload signature, watching for file uploads to iCagenda's event image/attachment endpoints where the submitted content or resulting file extension deviates from expected image/document types (e.g., PHP, PHTML, or other server-executable extensions masquerading as media files). Correlated indicators include unexpected file creation in web-accessible upload directories followed by immediate HTTP requests to the newly created path — a strong signal of web shell staging and first-use.

This logic ships across our full SIEM coverage: Microsoft Sentinel (KQL), Splunk (SPL), Elastic (EQL), IBM QRadar (AQL), Sumo Logic, Google Chronicle (YARA-L), and CrowdStrike (CQL) — so teams can deploy consistent detection regardless of their existing stack.

Full Detection Details

For the complete detection logic, MITRE ATT&CK mapping, and ready-to-deploy queries across all supported SIEM platforms, see the CVE-2026-48939 detection page.