CVE-2026-94131 in Enterprise Extension

Zusammenfassung

von MITRE • 26.09.2026

Joomla Extension - acymailing.com - Unauthenticated arbitrary file deletion in AcyMailing Enterprise extension < 11.1.0 - A subscriber could store a path in a file-type custom field and have AcyMailing delete that file when the field was cleared, including files outside the upload folder such as configuration.php.

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

• Zuständig: Joomla
• Reservieren: 20.09.2026
• Veröffentlichung: 26.09.2026
• Moderieren: akzeptiert
• Eintrag: VDB-410741
• CPE: bereit
• CWE: CWE-22 (bestätigt)
• CVSS: 6.5 (VulDB)
• EPSS: 0.00000
• KEV: nein
• Aktivitäten: very low

Quellen

• MITRE: https://www.cve.org/CVERecord?id=CVE-2026-94131
• NVD: https://nvd.nist.gov/vuln/detail/CVE-2026-94131
• CVE Details: https://www.cvedetails.com/cve/CVE-2026-94131/