Joomla Exploits
This repository contains selected Joomla exploit artifacts validated against real Docker Joomla environments. The collection is split by practical offensive utility.
real-impact
Exploits with direct security impact: RCE, file upload to code execution, SQL injection, sensitive configuration disclosure, arbitrary file deletion, stored XSS against an administrator, or privilege escalation.
| Order | CVE | CVSS | Target | Exploit script |
|---|
| 1 | CVE-2026-48939 | 10.0 | iCagenda public event attachment upload | cve_2026_48939_icagenda_real_http_rce.py |
| 2 | CVE-2026-21628 | 10.0 | Astroid Framework com_ajax media file manager | cve_2026_21628_astroid_real_http_rce.py |
| 3 | CVE-2026-48907 | 10.0 | JCE com_jce profiles.import profile upload | cve_2026_48907_jce_real_http_rce.py |
| 4 | CVE-2026-48908 | 10.0 | SP Page Builder asset.uploadCustomIcon custom icon upload | cve_2026_48908_sppagebuilder_real_http_rce.py |
| 5 | CVE-2023-23753 | 9.8 | Visforms addSupportedFieldType | cve_2023_23753_visforms_real_http_sqli.py |
| 6 | CVE-2026-49048 | 9.8 | JoomCCK com_joomcck tags.save | cve_2026_49048_joomcck_real_http_sqli.py |
| 7 | CVE-2025-22204 | 9.8 | Regular Labs Sourcerer alternate PHP syntax | cve_2025_22204_sourcerer_real_http_rce.py |
| 8 | CVE-2025-26854 | 9.8 | Articles Good Search mod_articles_good_search | cve_2025_26854_articles_good_search_real_http_sqli.py |
| 9 | CVE-2025-26855 |
conceptual-pocs
PoCs that demonstrate real vulnerabilities but are less directly useful as standalone intrusion primitives. They are retained for research, chaining, or defensive validation.
Usage
- Enter one CVE directory under
real-impact/ or conceptual-pocs/.
- Start the lab when a
docker-compose.yml is present: docker compose up -d.
- Read the CVE
README.md and, when present, exploits/README.md for setup notes.
- Run the exploit script from the CVE directory or pass the target URL explicitly.
No proprietary vulnerable extension ZIPs or Joomla distribution ZIPs are included. Download vulnerable software from the links in each CVE README and test only in authorized local labs.
Unvalidated candidates
Three records that were previously mistaken for public exploits remain gated
on unavailable commercial or historical packages. Their exact blockers are
documented in unvalidated-candidates and no
unvalidated exploit is published for them.
Installation limitations
CVE-2025-54300 and CVE-2025-54301 were validated through real Quantum Manager 3.2.0 HTTP routes in Joomla Docker using unchanged source from official commit 1bf656d. That source package did not complete Joomla's standard installer, so the lab copied the official component files into Joomla and registered its metadata manually. Their directories document this limitation and include the registration SQL; they do not claim a one-command clean installation or redistribute vulnerable packages.
aramosf/joomla_exploits
