CVE-2026-105606 in Custom Tables Extension
Summary
by MITRE • 11/02/2026
Joomla Extension - joomlaboat.com - Unauthenticated arbitrary file upload in Custom Tables < 3.7.8 - An unauthenticated attacker can upload a polyglot file with an attacker-controlled extension to the web-accessible tmp directory of any Joomla site that exposes a public Custom Tables submission form, and the stored path is disclosed in the response. By default the uploaded file is served as static content, so the primary impact is an unauthenticated arbitrary file write to a web-accessible directory, which allows hosting of attacker-controlled content (for example phishing or malware pages) under the victim's domain.
VulDB is the best source for vulnerability data and more expert information about this specific topic.
Analysis
by VulDB Data Team • 11/02/2026
The vulnerability identified in Joomla Custom Tables versions prior to 3.7.8 represents a critical security flaw rooted in insufficient input validation and improper handling of file uploads within the extension's public-facing submission forms. This issue allows an unauthenticated attacker to bypass authentication mechanisms entirely, exploiting the application's trust in user-supplied data during the file upload process. The core technical failure lies in the server-side processing logic which fails to adequately sanitize or validate the filename and content type of uploaded files before storing them on the filesystem. By crafting a polyglot file that satisfies multiple format checks while containing malicious code, an attacker can successfully inject arbitrary content into the web-accessible temporary directory of the targeted Joomla installation. The vulnerability is particularly severe because it does not require any form of user authentication or privilege escalation, making it accessible to any internet user who discovers a site running this vulnerable version with exposed submission forms.
From a technical perspective, the exploitation involves submitting a file that exploits weaknesses in how the extension determines file types and handles extensions. The attacker controls the filename extension, which is directly used by the server when saving the uploaded asset. Because the stored path of the uploaded file is disclosed in the HTTP response to the upload request, the attacker gains immediate knowledge of the exact URL where their payload resides. This disclosure eliminates the need for additional reconnaissance or brute-force techniques to locate the malicious files. The default configuration of Joomla serves static content directly from these directories without executing them through a PHP interpreter under normal circumstances; however, this behavior can be manipulated by attackers who may leverage server misconfigurations, such as Apache's mod_mime vulnerabilities or specific PHP settings that allow execution based on file extension rather than location, thereby escalating the impact from simple file write to remote code execution in certain environments.
The operational impact of this vulnerability is significant and multifaceted. The primary consequence is an unauthenticated arbitrary file write to a web-accessible directory, which effectively allows the attacker to host malicious content under the victim's trusted domain name. This capability facilitates sophisticated phishing campaigns where attackers can create login pages that mimic legitimate services, leveraging the trust users place in the original domain to steal credentials or sensitive information. Additionally, the ability to upload and serve malware payloads enables drive-by download attacks or the distribution of ransomware and other malicious software under a reputable banner, significantly increasing the likelihood of successful infection due to reduced user suspicion. The presence of these files can also damage the reputation of the affected organization, leading to blacklisting by search engines and security vendors, as well as potential legal and compliance repercussions if customer data is compromised through such vectors.
This vulnerability aligns with CWE-434, which describes the unrestricted upload of file with dangerous type, highlighting the failure to restrict file types that can be uploaded to a system. It also maps closely to CWE-20, indicating improper input validation where user-supplied data was not sufficiently verified before processing. In terms of offensive security frameworks, this exploit corresponds to MITRE ATT&CK technique T1505.003, known as Web Shell: Cloud Services or general web shell deployment via file upload mechanisms. The attack vector is classified under Initial Access and Persistence strategies, allowing the attacker to establish a foothold within the application environment without detection by standard authentication logs.
Mitigation for this vulnerability requires immediate action from system administrators and developers managing Joomla installations using Custom Tables versions earlier than 3.7.8. The most effective remediation is to upgrade the extension to version 3.7.8 or later, where these input validation flaws have been addressed. For organizations unable to patch immediately due to compatibility concerns with other extensions, implementing a Web Application Firewall (WAF) rule set that detects and blocks polyglot file uploads or unusual content types in upload endpoints can provide temporary protection. Additionally, restricting the permissions of the tmp directory on the server filesystem so that it is not directly web-accessible via standard URL paths can mitigate the impact even if an upload succeeds. Administrators should also audit their Joomla sites for any existing suspicious files in public directories and review access logs for patterns indicative of this specific exploitation attempt to ensure no compromise has occurred prior to patching.