CVE-2026-48939: iCagenda -- Dual-Path File Upload RCE and Access Control Bypass

Background

iCagenda is a widely used events calendar and management component for Joomla. Its “Submit an Event” front-end form allows site visitors to propose events for the calendar — a feature designed for community site-building that, through version 4.0.7 and 3.9.14, contained two independent vulnerabilities that together or separately enable unauthenticated attackers to execute arbitrary code or bypass access controls.

CVE-2026-48939 was assigned to cover both weaknesses. A public proof-of-concept appeared on GitHub at https://github.com/Polosss/By-Poloss..-..CVE-2026-48939 shortly after the June 2026 patches, and automated exploitation was observed beginning on June 15, 2026 — the same day the fix was released.

CISA added the CVE to the Known Exploited Vulnerabilities catalogue. Federal agencies face a remediation deadline of July 13, 2026.

Technical Mechanism

CVE-2026-48939 covers two distinct weaknesses with different scope:

Attack Path 1: PHP File Upload via Event Submission (Joomla 6 only)

The iCagenda “Submit an Event” form accepts file attachments as part of event proposals. In affected versions, the file upload handler used a disallowed-extension blocklist rather than an allowed-extension allowlist. This is a known-weak pattern: any extension not explicitly listed as forbidden passes through.

An attacker could upload a PHP file via the form’s attachment field:

POST /index.php?option=com_icagenda&task=events.save
Content-Type: multipart/form-data

[... event form fields ...]
[file field: malicious.php containing <?php system($_GET['cmd']); ?>]

The uploaded file was written to:

/images/icagenda/frontend/attachments/<filename>

This path is under the Joomla web root. On Joomla 6 installations, the directory lacked a .htaccess file disabling PHP execution, so the uploaded PHP file is directly executable.

Scope: This attack path achieves RCE only on Joomla 6 installations (earlier Joomla versions typically shipped with PHP execution disabled in media directories via server configuration).

Attack Path 2: Controller Access Control Bypass (all Joomla versions)

The second weakness is more broadly applicable. iCagenda’s controller layer failed to verify that the requesting user had appropriate permissions before executing certain controller actions. This allows unauthenticated or low-privileged users to trigger controller methods that should be restricted to authenticated users or administrators.

Depending on the specific actions exposed, the bypass could enable:

• Creating or modifying event records without authentication
• Accessing or modifying administrative data via the front-end component

This path affects all supported Joomla versions, not just Joomla 6.

Why disabling the component doesn’t help

The access control bypass operates at the Joomla routing layer in a way that a simple component disable in the extension manager does not fully block. Traffic still reaches the component’s router before the disable check resolves. Administrators who believe they have mitigated the issue by disabling iCagenda in the backend may still be exposed to the access control bypass path.

Real-World Exploitation Evidence

Automated exploitation of CVE-2026-48939 began on June 15, 2026 — the same day the fix was published — indicating that threat actors were monitoring the advisory and had tooling ready to deploy against the disclosed attack pattern.

A distinctive characteristic of the automated exploit campaigns:

• User-Agent string: icagenda-batch/1.0 — a hardcoded identifier used by the exploit tool, making log-based detection straightforward
• Target pattern: POST requests to com_icagenda&task=events.save with PHP file payloads in the attachment field, immediately followed by GET requests to /images/icagenda/frontend/attachments/ for the uploaded file

The icagenda-batch/1.0 user agent provides a high-confidence, low-false-positive indicator for scanning across log archives.

Impact Assessment

Path 1 (PHP upload, Joomla 6): Full unauthenticated remote code execution. Web shell access as the web server user provides:

• Arbitrary command execution
• Joomla configuration.php access (database credentials)
• File system read/write within web server permissions
• Ability to install persistent backdoors

Path 2 (Access control bypass, all versions): Depends on which controller actions are exposed, but at minimum allows unauthenticated event creation/modification and potentially exposes data or functionality restricted to authenticated users. Lower-severity than Path 1 but broader in scope (not limited to Joomla 6).

Combined: Sites running Joomla 6 with iCagenda in the affected range are exposed to both attack paths, with the RCE path providing the highest-severity outcome.

Affected Versions

Remediation Steps

1. Update immediately. Apply iCagenda 4.0.8 (for 4.x installations) or 3.9.15 (for 3.x installations) via Joomla’s Extension Manager. Do not rely on disabling the component as a mitigation — the access control bypass may still be reachable.

2. Search for PHP files in the attachments directory:

find /path/to/joomla/images/icagenda/ -name "*.php" -o -name "*.phtml" -o -name "*.php7"

3. Review web server logs for the exploit tool user agent:

grep "icagenda-batch/1.0" /var/log/apache2/access.log
grep "icagenda-batch/1.0" /var/log/nginx/access.log

4. Review POST requests to iCagenda’s event submission endpoint:

grep "com_icagenda.*events.save" /var/log/apache2/access.log

5. If evidence of compromise is found: Treat as a full incident. Rotate database credentials, audit all files in the web root for additions, and consider a full server audit before return to production.

6. Block the attachments directory from PHP execution as a defence-in-depth measure (add or verify .htaccess in /images/icagenda/frontend/attachments/):

<Files "*.php">
    Order Deny,Allow
    Deny from all
</Files>

This does not fix the underlying vulnerability but limits the impact of the file upload path if patching is delayed.

Detection Guidance

High-confidence IOC (exploit tool fingerprint):

# User-Agent: icagenda-batch/1.0
grep -i "icagenda-batch" /var/log/apache2/access.log
grep -i "icagenda-batch" /var/log/nginx/access.log

WAF rule:

SecRule REQUEST_HEADERS:User-Agent "@streq icagenda-batch/1.0" \
    "id:9002701,phase:1,deny,status:403,\
    msg:'iCagenda exploit tool blocked (CVE-2026-48939)'"

Suricata signature:

alert http $EXTERNAL_NET any -> $HTTP_SERVERS any (msg:"iCagenda CVE-2026-48939 Exploit Tool User-Agent"; flow:established,to_server; http.header; content:"icagenda-batch/1.0"; nocase; threshold:type limit, track by_src, count 1, seconds 60; sid:9002702; rev:1;)

Timeline

References

• NVD — CVE-2026-48939
• CISA KEV — CVE-2026-48939
• Public PoC — CVE-2026-48939
• iCagenda Changelog