CVE-2026-105606

waiting for further signals

EUVD-2026-115367 ↗

no check availablenot proven exploitable

cve.orgpublic pockev

joomlaboat.com Custom Tables extension for Joomla 1.0-3.7.7

CWE-434 Unrestricted Upload of File with Dangerous Type

ETK-2026-3310, permanent identifier

cvss9.5cna vendorCVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H

6h 22msince last run

19mAI analysis

timeline

0 = cve.org publication

trigger signal (cve.org) +0hwaiting for further signals+1h57m

+4h

+6h

+8h

+10h

+12h

description

Custom Tables for Joomla versions before 3.7.8 are affected by an unauthenticated file-upload vulnerability. An attacker can place attacker-controlled content in a web-accessible temporary directory when the site exposes a public Custom Tables submission form, potentially allowing content to be served from the site’s domain.

mitigation

Update Custom Tables to version 3.7.8 or later. Until updates are complete, disable public Custom Tables submission forms or restrict them to trusted users.

check

exploit

automation

contextual

auth required

EPSS

–

agent run time

19m

cve.org record, t = 0

2026-11-02 19:01Z

Δ to public poc

–

Δ to kev

–

outcome

Contextual, not validated: no deterministic check could cover this one, and no technique passed our review.

source signals

Public signals that triggered or updated the pipeline. These are inputs for the deltas above.

2026-11-02 19:01Z
cve_org: trigger signal, started the run
https://www.cve.org/CVERecord?id=CVE-2026-105606

this entry in the feed

GET /api/v1/feed/CVE-2026-105606

{
  "etk_id": "ETK-2026-3310",
  "cve_id": "CVE-2026-105606",
  "display_id": "CVE-2026-105606",
  "ghsa_id": null,
  "euvd_id": "EUVD-2026-115367",
  "status": "published",
  "anchor_state": "anchored",
  "title": "Unauthenticated file upload in Custom Tables for Joomla",
  "summary": "Custom Tables for Joomla versions before 3.7.8 are affected by an unauthenticated file-upload vulnerability. An attacker can place attacker-controlled content in a web-accessible temporary directory when the site exposes a public Custom Tables submission form, potentially allowing content to be served from the site’s domain.",
  "mitigation": "Update Custom Tables to version 3.7.8 or later. Until updates are complete, disable public Custom Tables submission forms or restrict them to trusted users.",
  "vendor": "joomlaboat.com",
  "product": "Custom Tables extension for Joomla",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0-3.7.7"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "Custom Tables extension for Joomla",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 9.5,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "contextual",
  "check": false,
  "check_confidence_basis": null,
  "exploit": false,
  "pipeline_minutes": 19.372336266666668,
  "t0_at": "2026-11-02T19:01:44.851000+00:00",
  "signals": {
    "trigger_signal": {
      "at": "2026-11-02T19:01:44.851000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-02T19:01:44.851000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-105606"
    }
  }
}

published 2026-11-02 20:39Z
last change 2026-11-03 02:23Z

Need the technical details behind an entry?

Every entry here shows what we attempted and when. The technical details, the generated exploit that fired it and the evidence behind the verdict are not public. Tell us about your use case and we’ll get back to you about extended API access.