CVE-2026-94132 File upload in AcyMailing Enterprise extension for Joomla
Attackers can upload PHP files via email to the monitored mailbox, leading to remote code execution on the Joomla server.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2026-94132?
CVE-2026-94132 is a critical vulnerability in acymailing.com AcyMailing Enterprise extension for Joomla, published on 26 Sep 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root.
Weakness: CWE-434
Which versions are affected by CVE-2026-94132?
It affects 1 product.
Products include Acymailing Acymailing.
How do I fix CVE-2026-94132?
No fix has been published for CVE-2026-94132 yet. Limit exposure of the affected software until one is available.
Is CVE-2026-94132 being exploited?
There is no known exploitation of CVE-2026-94132 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in acymailing.com AcyMailing Enterprise extension for Joomla
- CVE-2023-28731 Unauthenticated RCE affecting the AcyMailing plugin for Joomla
- CVE-2026-56292 Joomla Extension - acymailing.com - SQL Injection in AcyMailing extension < 10.11.1
- CVE-2026-94131 Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0
- CVE-2024-7384 AcyMailing <= 9.7.2 - Authenticated (Subscriber+) Arbitrary File Upload via acym_extractArchive Function
- CVE-2023-28733 Stored XSS affecting the AcyMailing plugin for Joomla
Sources
Also known as GHSA-x2ch-94w5-cr2g.