---
id: CVE-2026-102785
title: >-
  Joomla Extension - yootheme.com - Unauthenticated remote code execution in
  YOOtheme Pro 5.0.0-5.0.52
summary: >-
  Joomla Extension - yootheme.com - Unauthenticated remote code execution in
  YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image
  transformation handler incompletely binds normalized image operations and the
  output destinat…
severity: critical
cvss: 10
cvssVector: 'CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:H/SI:H/SA:H/E:A/AU:Y'
cvssSource: cna
cwe:
  - CWE-434
vendor: yootheme.com
product: YOOtheme Pro extension for Joomla
affected:
  - yootheme_pro_extension_for_joomla 5.0.0-5.0.52
ssvc:
  exploitation: none
  automatable: 'yes'
  technicalImpact: total
  timestamp: '2026-10-22T13:25:05.291458Z'
exploitAvailable: true
published: '2026-10-22'
updated: '2026-10-22'
sourceUpdated: '2026-10-22T15:04:40.346Z'
source: CVEORG
sourceUrl: 'https://www.cve.org/CVERecord?id=CVE-2026-102785'
references:
  - url: 'https://www.yootheme.com/'
tags:
  - cve.org
  - exploit-available
exploits:
  github: 1
  githubRepos:
    - >-
      https://github.com/BIBILZERODAY/CVE-2026-102785---YooTheme-Mass-Exploit-Webshell.Store-
  checkedAt: '2026-10-22T22:01:26.490Z'
ingestedAt: '2026-10-22T22:00:50.282Z'
---

## Overview

Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.

## Affected

- `yootheme_pro_extension_for_joomla 5.0.0-5.0.52`

## Remediation

Refer to the linked advisories for vendor-supplied fixes and affected version ranges.