CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0

What is CVE-2026-94131?

CVE-2026-94131 is a high-severity path traversal vulnerability in acymailing.com AcyMailing extension for Joomla, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.

Weakness: CWE-89

Which versions are affected by CVE-2026-94131?

It affects 1 product.

Products include Acymailing Acymailing.

How do I fix CVE-2026-94131?

No fix has been published for CVE-2026-94131 yet. Limit exposure of the affected software until one is available.

Upgrade, and resolve every user-supplied path against an allowed base folder before opening it. More about Path traversal.

Is CVE-2026-94131 being exploited?

There is no known exploitation of CVE-2026-94131 in the wild and no public exploit code.

Other vulnerabilities in acymailing.com AcyMailing extension for Joomla

• CVE-2023-28731 Unauthenticated RCE affecting the AcyMailing plugin for Joomla Critical 9.8
• CVE-2026-94132 File upload in AcyMailing Enterprise extension for Joomla Critical 9.5
• CVE-2026-56292 Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1 Critical 9.2
• CVE-2024-7384 AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function High 7.5
• CVE-2023-28733 Stored XSS affecting the AcyMailing plugin for Joomla High 7.2

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as GHSA-657v-94xx-8q7f.