CVE-2026-102785
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro…
- Risk score
- 76/100
- CVSS
- 10.0 v4.0
- Exploit chance (30 days)
- 0.7%
- Published
- 22 Oct 2026
Open in the live forecast Today's forecast
What to know
- What it is
- An unauthenticated remote attacker can inject code and write a file to a public directory in YOOtheme Pro versions 5.0.0-5.0.52. This could allow the attacker to execute arbitrary code.
- Affected
- {'product': 'YOOtheme Pro', 'version': '5.0.0-5.0.52'}
- Fix
- Check the linked advisory for a fix, as none is provided here.
- Exploitation
- No known exploitation
Why it is Amber
- CVSS 10.0 critical
- Remotely exploitable without logging in
References
Original description
Joomla Extension - yootheme.com - Unauthenticated remote code execution in YOOtheme Pro 5.0.0-5.0.52 - YOOtheme Pro’s publicly accessible image transformation handler incompletely binds normalized image operations and the output destination to its request signature. An unauthenticated remote attacker can reuse a signature disclosed in a legitimate public image URL, inject additional image operations, traverse out of the intended cache directory, and write an attacker-controlled PNG/PHP polyglot to an executable public media directory.
Last activity 22 Oct 2026. Patch Forecast updates every hour.