CVE-2026-94132 in Enterprise Extension
Summary
by MITRE • 09/26/2026
Joomla Extension - acymailing.com - Remote Code Execution vulnerability in mailbox action feature in AcyMailing Enterprise extension < 11.1.0 - MIME parts of incoming emails were saved to media/com_acym/upload/ with no extension check, so anyone who could email the monitored mailbox could write a PHP file into the web root.
If you want to get the best quality for vulnerability data then you always have to consider VulDB.
Analysis
by VulDB Data Team • 09/26/2026
The vulnerability identified in AcyMailing Enterprise versions prior to 11.1.0 represents a critical Remote Code Execution flaw stemming from improper input validation within its mailbox integration feature. This extension allows Joomla websites to receive and process emails through specific actions, including the ability to save attachments or content from incoming messages. The core technical failure lies in how the application handles MIME parts of these incoming emails when saving them to the server's file system. Specifically, the code writes data directly into the media/com_acym/upload/ directory without performing any validation on the filename extensions or the content type of the uploaded files. This lack of sanitization creates a direct path for attackers to bypass standard web application security controls that typically rely on extension-based filtering mechanisms.
From an operational perspective, this flaw allows any individual with access to send emails to the monitored mailbox associated with the AcyMailing configuration to execute arbitrary code on the target server. By crafting a malicious email containing a PHP script disguised as another file type or simply omitting an extension that might trigger validation errors in other contexts, an attacker can force the application to save this payload directly into the web root directory. Since the upload path is located within the publicly accessible media folder of the Joomla installation, the saved PHP file becomes immediately executable via a standard HTTP request. This effectively grants the attacker full control over the server environment corresponding to that user account or potentially higher privileges depending on the web server's configuration and the permissions assigned to the web process.
This vulnerability aligns with CWE-434, which describes the unrestricted upload of files with dangerous types, as well as CWE-20, indicating improper input validation. In terms of offensive security frameworks such as MITRE ATT&CK, this exploit maps directly to T1505.003, Server Software Component: Web Shell, where adversaries install web shells for persistent access and lateral movement. The ability to write arbitrary files into a writable directory within the application's root is a classic indicator of server-side request forgery or direct file inclusion vectors that have been prevalent in content management systems for decades. The severity is heightened because it does not require authentication if the mailbox action is configured to accept emails from any source, although even authenticated users with limited permissions could potentially exploit this if they can send emails to the monitored address.
Mitigation strategies must prioritize immediate patching and configuration hardening. Administrators running AcyMailing Enterprise versions older than 11.1.0 should upgrade to the latest stable release where this validation logic has been corrected to enforce strict extension whitelisting or content type verification before saving files. For environments that cannot be immediately patched, temporary mitigations include restricting access to the monitored mailbox so that only trusted sources can send emails, although this is often impractical for public-facing contact forms or newsletter subscriptions. Additionally, web server configurations should be reviewed to ensure that the upload directory does not have execute permissions enabled for PHP scripts. Disabling script execution in specific directories via .htaccess rules on Apache or equivalent configuration blocks on Nginx can provide a layer of defense-in-depth even if an attacker successfully uploads a malicious file. Regular auditing of uploaded files and monitoring server logs for unusual POST requests to the upload directory are also recommended practices to detect potential exploitation attempts early.