{"id":"CVE-2026-102785","title":"Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52","summary":"Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destinat…","severity":"critical","cvss":10,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y","cvssSource":"cna","cwe":["CWE-434"],"vendor":"yootheme.com","product":"YOOtheme Pro extension for Joomla","affected":["yootheme_pro_extension_for_joomla 5.0.0-5.0.52"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"total","timestamp":"2026-10-22T13:25:05.291458Z"},"exploitAvailable":true,"published":"2026-10-22","updated":"2026-10-22","sourceUpdated":"2026-10-22T15:04:40.346Z","source":"CVEORG","sourceUrl":"https://www.cve.org/CVERecord?id=CVE-2026-102785","references":[{"url":"https://www.yootheme.com/"}],"tags":["cve.org","exploit-available"],"exploits":{"github":1,"githubRepos":["https://github.com/BIBILZERODAY/CVE-2026-102785---YooTheme-Mass-Exploit-Webshell.Store-"],"checkedAt":"2026-10-22T22:01:26.490Z"},"ingestedAt":"2026-10-22T22:00:50.282Z","slug":"CVE-2026-102785","body":"## Overview\n\nJoomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.\n\n## Affected\n\n- `yootheme_pro_extension_for_joomla 5.0.0-5.0.52`\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.","depth":"abyssal","depthScore":67,"depthScoreParts":{"impact":55,"likelihood":0,"exploitation":12,"ransomware":0},"changes":[]}