CVE-2026-102785 Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52
- Exploited in the wild
- Not known
- Fix
- None listed
What is CVE-2026-102785?
CVE-2026-102785 is a critical vulnerability in yootheme.com YOOtheme Pro extension for Joomla, published on 22 Oct 2026.
Official description
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
Weakness: CWE-434
Which versions are affected by CVE-2026-102785?
How do I fix CVE-2026-102785?
No fix has been published for CVE-2026-102785 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-102785 being exploited?
There is no known exploitation of CVE-2026-102785 in the wild and no public exploit code.
Public exploit code: 2 proofs of concept on GitHub.
Sources
Also known as GHSA-8w8j-f6ph-29mm.