CVE-2026-94131 in Enterprise Extension
Summary
by MITRE • 09/26/2026
Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified within the AcyMailing Enterprise extension for Joomla versions prior to 11.1.0 represents a critical security flaw classified under CWE-22: Improper Limitation of a Pathname to a Restricted Directory, often referred to as path traversal or directory traversal. This issue stems from insufficient input validation and sanitization mechanisms when processing user-supplied data within custom fields designed for file uploads. The core technical failure occurs during the lifecycle management of subscriber records, specifically when an administrator or automated process clears a field that was previously populated with a file-type entry. Instead of merely removing the reference to the uploaded asset within the database or deleting only files located in designated safe directories, the application logic directly interprets and executes deletion commands on the raw path string provided by the user during initial data entry.
An unauthenticated attacker can exploit this flaw by registering as a new subscriber on a Joomla site running the vulnerable version of AcyMailing. During the registration process or subsequent profile updates, the attacker populates a file-type custom field with an absolute or relative path pointing to sensitive files outside the intended upload directory structure. Common targets include configuration.php, which contains database credentials and other critical application settings, as well as index.php files in core directories that could be used for defacement or further exploitation vectors. Once this malicious data is stored, any subsequent action by a site administrator that triggers the clearing of subscriber fields results in the immediate deletion of the specified file from the server's filesystem via standard operating system commands invoked by the PHP application.
The operational impact of this vulnerability is severe and potentially catastrophic for Joomla-based websites. The arbitrary file deletion capability allows an attacker to disrupt service availability by removing essential configuration files, leading to a complete site outage or white screen of death due to missing database connection parameters. Furthermore, if critical component files are deleted, the integrity of the entire application stack may be compromised, requiring extensive manual restoration from backups and potentially resulting in significant data loss if backup procedures were not rigorously maintained. This vulnerability also facilitates denial-of-service attacks against specific applications hosted on shared servers by targeting configuration or log files belonging to other services sharing the same filesystem environment.
From a threat intelligence perspective, this exploit aligns with ATT&CK technique T1485: Data Destruction, where an adversary aims to destroy data and infrastructure resources rather than exfiltrate them. The attack vector is categorized as Unauthenticated Access (T1078) combined with Local File Inclusion/Deletion patterns found in web application attacks. Because the vulnerability does not require authentication for the initial setup of the malicious path, it poses a significant risk to any public-facing Joomla site using AcyMailing Enterprise versions below 11.1.0 without additional security hardening measures such as WAF rules specifically targeting file manipulation parameters or strict input validation at the framework level.
Mitigation strategies must prioritize immediate remediation through software updates and defensive configuration changes. The primary solution is to upgrade the AcyMailing extension to version 11.1.0 or later, where the developers have implemented proper path canonicalization and restricted deletion operations exclusively to whitelisted directories within the Joomla uploads folder. For sites unable to update immediately due to compatibility constraints with other plugins, administrators should disable file-type custom fields entirely if they are not strictly necessary for business logic. Additionally, implementing strict input validation on all user-supplied data that interacts with filesystem operations is essential. Security teams should also ensure that web server configurations restrict write permissions to only the necessary directories and employ monitoring solutions to detect unusual patterns of file deletions or access attempts to sensitive configuration files outside standard application paths. Regular audits of custom field definitions and rigorous testing of edge cases in form submissions are recommended practices to prevent similar logic flaws from being introduced into Joomla extensions.