CVE-2026-48906 Extension - tassos.gr - Arbitrary File Deletion in Novarain/Tassos Framework < 6.1.0 for Joomla
Attackers can delete arbitrary files on Joomla sites using the Novarain/Tassos Framework plugin, potentially compromising site integrity.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-48906?
CVE-2026-48906 is a critical path traversal vulnerability in tassos.gr Advanced Custom Fields, published on 27 May 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The vulnerability in the Tassos Framework Plugin allows users to delete arbitrary files on the affected sites.
Weakness: CWE-284
Which versions are affected by CVE-2026-48906?
It affects 8 products.
Products include Tassos Advanced Custom Fields, Tassos Convert Forms, Tassos Engagebox, Tassos Google Structured Data, Tassos Mailchimp Auto-Subscribe, Tassos Smile Pack and 2 more.
How do I fix CVE-2026-48906?
No fix has been published for CVE-2026-48906 yet. Limit exposure of the affected software until one is available.
Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.
Is CVE-2026-48906 being exploited?
There is no known exploitation of CVE-2026-48906 in the wild and no public exploit code.
Sources
Also known as GHSA-wfvx-j6wj-x7w9.