CVE-2026-117551

{
  "etk_id": "ETK-2026-4298",
  "cve_id": "CVE-2026-117551",
  "display_id": "CVE-2026-117551",
  "ghsa_id": "GHSA-px9q-qw3v-wg6c",
  "euvd_id": "EUVD-2026-124608",
  "status": "triaged_in_scope",
  "anchor_state": "anchored",
  "title": "Improper file upload validation in jDownloads for Joomla",
  "summary": "jDownloads for Joomla releases before 4.1.8 do not adequately validate files submitted through frontend thumbnail uploads. An attacker with upload permission may place executable content on the server and execute PHP code.",
  "mitigation": "Upgrade jDownloads to version 4.1.8 or later. Until upgraded, disable frontend thumbnail uploads or remove upload permission from untrusted accounts.",
  "vendor": "jdownloads.com",
  "product": "jDownloads extension for Joomla",
  "affected": [
    {
      "affected_notes": [],
      "affected_ranges": [
        "1.0.0-4.1.7"
      ],
      "ecosystem": null,
      "fixed_versions": [],
      "package_name": "jDownloads extension for Joomla",
      "purl": null
    }
  ],
  "cwes": [
    434
  ],
  "cvss_score": 10,
  "cvss_src": "cna_vendor",
  "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y",
  "epss_score": null,
  "epss_percentile": null,
  "epss_asof": null,
  "automation": "deterministic",
  "check": true,
  "check_confidence_basis": "differential",
  "exploit": false,
  "pipeline_minutes": 47.209003966666664,
  "t0_at": "2026-11-12T17:58:35.141000+00:00",
  "signals": {
    "check": {
      "at": "2026-11-12T19:32:25.171489+00:00",
      "days": 0.06516238991898148,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T17:58:35.141000+00:00",
      "url": null
    },
    "trigger_signal": {
      "at": "2026-11-12T17:58:35.141000+00:00",
      "days": 0,
      "is_lower_bound": false,
      "measured_at": "2026-11-12T17:58:35.141000+00:00",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-117551"
    }
  }
}