CVE-2026-117551

jDownloads extension for Joomla remote code execution via frontend thumbnail upload

critical · 10.0

Fix listed

jDownloads extension for Joomla

Published Nov 12, 2026, 17:58 UTC

Description

Joomla Extension - jdownloads.com - RCE through file upload in jDownloads < 4.1.8 - Insufficient validation of frontend thumbnail uploads allowed users with upload permission to place executable files on the server. This results in PHP code execution.

Reported fixed versions

4.1.8

Official CVE record View source and advisories

Data from cve.now. Summaries, where shown, are licensed CC BY 4.0.