CVE-2026-100747 in Event Gallery Extension
Summary
by MITRE • 09/27/2026
Joomla Extension - svenbluege.de - CSRF in image upload in Event Gallery extension < 6.5.0 - Due to lack of an CSRF token check, a third-party site can upload files to an event and overwrite existing files with the same name.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 09/27/2026
The vulnerability identified in the Event Gallery extension for Joomla versions prior to 6.5.0 represents a critical failure in access control mechanisms, specifically concerning Cross-Site Request Forgery protections during file operations. This flaw allows unauthenticated or authenticated attackers to manipulate state-changing actions on behalf of a victim user without their knowledge or consent. The core technical deficiency lies in the absence of anti-CSRF tokens within the HTTP requests responsible for uploading images and managing event data. In secure web applications, these tokens are unique, secret values generated by the server and embedded in forms or required as parameters to verify that the request originated from a legitimate source controlled by the user. Without this verification step, any external website can craft malicious HTML pages containing hidden forms or JavaScript-driven requests that target the Joomla administrator interface or specific component endpoints associated with Event Gallery.
From an operational perspective, the impact of this vulnerability is severe due to its potential for arbitrary file upload and overwriting capabilities. An attacker leveraging this flaw can force a logged-in administrator or user with sufficient privileges to upload malicious files into directories accessible by the web server. By exploiting the ability to overwrite existing files with identical names, an adversary can replace legitimate image assets with PHP shells, JavaScript payloads, or other executable content. This effectively leads to remote code execution on the target system if the uploaded file is subsequently accessed through a browser path that interprets it as code. Even without immediate code execution, the integrity of the website's media library and event presentations is compromised, allowing for defacement, data exfiltration via steganography in images, or further lateral movement within the network infrastructure hosting the Joomla instance.
This vulnerability aligns with CWE-352, which describes Cross-Site Request Forgery as a weakness where an attacker causes a user to submit a request they did not intend to make. Furthermore, it maps directly to MITRE ATT&CK technique T1078, Valid Accounts, particularly when the attack relies on tricking an authenticated administrator into performing actions that escalate privileges or compromise system integrity. The specific action of uploading files corresponds to CWE-434, Unrestricted Upload of File with Dangerous Type, and overwriting existing resources relates to CWE-629, Use of a Broken or Insecure Cryptographic Algorithm if encryption is involved in file naming, though the primary issue remains the lack of request validation. The combination of these factors creates a high-severity risk vector that exploits trust relationships between browsers and web applications.
Mitigation strategies must focus on immediate patching and enhanced security configurations. Administrators should upgrade the Event Gallery extension to version 6.5.0 or later, where this CSRF check has been implemented by the developer Sven Bluege. In cases where upgrading is not immediately feasible, temporary mitigations include restricting access to the Joomla administrator interface through IP whitelisting or two-factor authentication, although these do not fully eliminate the risk if an admin visits a malicious site while logged in. Implementing Content Security Policy headers can also help mitigate some aspects of client-side attacks by limiting where scripts and forms can submit data. Long-term remediation requires enforcing strict CSRF token validation on all state-changing endpoints within custom Joomla components, ensuring that every POST request includes a valid, server-validated anti-CSRF token to guarantee the authenticity of the user's intent.